Disregarding collisions, two users having the same hash value means that both of them have the same password, salt, and pepper. Consequently, this usually means one of two things
The site uses a fixed salt for all users: This renders the scheme to a pepper-only password hashing scheme (the "salt" is in the code). By means of brute force, and by employing knowledge of a plaintext password, you can find out the value of said "salt".
This, of course, can be done by registering another account of your choice and attempting to brute-froce something like hash(password + X)
, with X
being the value you want to find out, and then comparing the output to the hash you extracted after creating your new account.
A site doing something as stupid as using a hardcoded salt (pepper-only) will probably be using something like MD5 or SHA-1, which will make your brute-force attack much faster.
The site uses non-unique salts derived from certain information from the user: (username, email, etc.) which you can find out by means of brute-force.
Since the database you extracted didn't contain any salts, it is most likely the case #1.
Note: Just because a duplicate hash wasn't found in rainbow tables, that doesn't mean it's an easy password. It might be the same user with two accounts using the same strong password.