I don't know what happened in this case, but it doesn't seem very difficult: 1. Configure server to use password authentication and allow logins from anywhere.

I don't know what happened in this case, but it doesn't seem very difficult: 1. Configure server to use password authentication and allow logins from anywhere. 2. Send password to user via unencrypted email. There's a reason that people are uncomfortable receiving passwords via email.