Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the disclosure of the credentials of a user allow (against the user)?
If the VPN provider doesn't log any user data, is there any way that past traffic could be inferred by the attacker? Does this allow the attacker to read (ie. decrypt) all future traffic of the user?