I think that it's the conjunction of the password and the harassment accusation together that make this a fairly straightforward case. If it were just a creepy

I think that it's the conjunction of the password and the harassment accusation together that make this a fairly straightforward case. If it were just a creepy password, well, that demonstrates a certain level of creepiness but doesn't mean that he made it a problem for anyone else. It's possible to have private fantasies that remain private. On the other hand, if it was just the coworker's accusation, it would be just that, an accusation without evidence. The password as evidence of private creepiness lends credence to the accusations of harassment, and the accusation of harassment demonstrates the the creepiness was probably not just private. Together they create a case stronger than either alone.