The site’s back-end was left without a password for weeks.