I think its brute forced .... bacause the password was dictionary based... but they can add brute force detection to their website ? or not?