Clearly it was the services that weren't tech-savvy using a non-changeable non-secret ID as some kind of authentication. Can't blame the users here.