Usernames and passwords stolen from a third party were used to book free trips or upgrades on American and United Airlines: yet another sad tale of password reuse!