You see the occasional emu/box that creates account through login;
'Login with your username as password to create an account'
-Thus the details can be read
I occasionally make the mistake of trying to login with my retail information on private servers.
Now I know that people haven't really thought into this yet to be checking all logins and scamming people for it, but is it possible that private servers can phish my account details from a wrong login?
Or even a virus changing my realmlist to do as much?