There's a few ways someone could do this that wouldn't use "store password in plain text". A MITM attack using remote access to a router/server would work if a

There's a few ways someone could do this that wouldn't use "store password in plain text". A MITM attack using remote access to a router/server would work if a webmail login didn't require SSL (or if the attacker is sophisticated enough, it would work even if SSL was on). I can think of a few ways one could social engineer their way to that level or just escalate by gathering data. Even something as simple as cracking the home WIFI router of an unsuspecting employee, and use those credentials as a base point to work your way up the access chain. Lots of places spend loads of time securing the border to prevent outside access, but don't spend loads of time preventing users with access from escalating. I know we're talking about the FBI, but really it only takes one small mistake.