looks like a super bad and stupid bug. you can log into locked accounts just by sending a really long random shit "account takes any password between 257 and 1024 characters"