TL;DR: Because of how Windows authenticates network users in a non-Kerberos (non-Active Directory) scenarios, password hashes work just as well as passwords for authenticating network users.
Long version: There are two traditional ways to use a password to authenticate someone:
- The client sends the password to the server (traditionally, in cleartext, although newer protocols use encryption). The server takes the password, hashes it, and compares it to the password hash it has stored. If the hashes match, then the client is assumed to have the correct password and is treated as authenticated.
- Challenge-response: The server generates a challenge (a random byte sequence) and sends it to the client. The client takes the challenge, combines it with the client's password, hashes the result, and sends the hash to the server. Meanwhile, the server takes the challenge, combines it with the password it has stored, and hashes the result. If the two hashes match, then the client is treated as authenticated.
Note that, under a challenge-response scheme, the password is never actually sent to the server (which is good), but the server needs to know the password (which is bad). The first approach is the traditional Unix approach; the second is the traditional Windows approach.
To mitigate the "server needs to know the password" disadvantage of challenge-response, many challenge-response implementations use a hash of the password. In other words, instead of comparing the hash of
(challenge + password), implementations compare the hash of
(challenge + hashed password). However, in this case, the hashed password is still all you need to access the service (because a malicious client can send the hash of
(challenge + hashed password) even if it doesn't know the cleartext password). So hashing passwords under a challenge-response scheme make it harder to get a cleartext password that could presumably be used to attack other services, but it makes no difference in terms of the security of the service itself.
Further reading and references: