Which of the following MOST likely allowed the attacker to guess the password?