They require a username / password combo, and I'm gonna go ahead and say they don't have access to the main FAS user database, so they have no way of detecting an intrusion.
Ūar ūarf nafn og lykilorđ og ég ætla ađ segja ađ ūeir hafi ekki ađgang ađ ađalgagnagrunninum svo ūeir verđi ekki varir viđ innlit án leyfis.