The difference is low-level thugs were able to get access rather than the automated collection services operated by the GCHQ, so now low-level thugs have his pa

The difference is low-level thugs were able to get access rather than the automated collection services operated by the GCHQ, so now low-level thugs have his passwords. The most salient point is how regular individuals are authorized to receive user passwords, and they're able to use them too. The article clearly states that the low-level thugs checked his email within his presence rather than him communicating the passwords to more secure individuals.