They don't have access to passwords, but what about the password hashes? Why not just transfer the hashes to the new system?