Account takeover is a thing that happens. I doubt HN has the best measures against credential stuffing.