My two cents: I guess they were using xmlrpc to post to the blog. The incutio xmlrpc library (or rather the metaweblog api which wordpress uses) requires that you send the username and password in the clear, so a man in the middle could easily gain access to their wordpress install.