An investigation found privileged users at the agency were replicating passwords across multiple accounts.