I think you mean the password you type in to connect the host to BAM!.
This host was probably attached to BAM! before. In that case, it will match the host CPID to a BAM! CPID or the host_authenticator to a BAM! authenticator and BAM! assumes this is the same host. There is never an actual login in that case.
The reason for this is that the host will send the password with each request, but when the password is changed (here on the website) each host that has an old password will be unable to connect if the password was also validated. Since the CPID and host_authenticator are unique and both are not public (the host CPID shown in the stats is NOT the same as the one in the BAM! request!) they are goo "enough" for authentication.
If there is a demand for it I will make it an option for users to always require a check on the password, even for hosts which are already joined to BAM!.
Please do not PM, IM or email me for support (they will go unread/ignored). Use the forum for support.