Pretty much.
Usually for websites it'd be some kind of Injection code, but i'd doubt he would have that kinda stuff.
Most likely just simply googled "<website> passwords" which usually brings up lists of username and passwords for various websites.
That wouldn't be necessary for names/passes...there are sites dedicated to that. Well...sites I know of at least. That google gimmick would have expired memberships of all sorts.