Let's also include the system itself, that allowed the account to have a password that short and apparently didn't require 2FA.