Well, there are cases where it's the user's fault and the exchange's fault. No exchange can make sure you won't post your password on some fake site.