Regardless of how the password was obtained (decryption, bad hashing, confession):
- Are there any prior known cases where the contents of the password was used to prove motive or guilt?
Or, looking at it from the perspective of an ISP doing anti-fraud checks: suppose 2 accounts have the same password hash; assume they also chose a very complex password, so any collision is unlikely to occur by chance.
Then the secondary account does something bad.
- Is it conceivable that the other account would be investigated just because of the similar hash?
- If the hash was unique enough could it be considered culpable by association?