@foone lol, yep... here's another vector:

I buy a decent amount of used enterprise hardware on ebay. guess how many former owner's ssh logins, smtp relays, bmc logins that I've come across? hahaha it's a lot.