Just because the member didn't give out his password doesn't mean that a script kiddie didn't guess it. They have brute force scripts that constantly run trying to guess different un/pw combinations to gain access into sites.
For instance the script will guess:
homer / simpson
bill / clinton
dallas / cowboys
Or whatever. It doesn't even have to be that well known of a combination. As long as it's two dictionary words, their scripts can guess it. I'm using StrongBox to prevent hacks like this since it uses cryptography. Here's their url, excellent anti hack script:
http://webmastersguide.com/?htaccess-cgi/strongbox/