Still possible to find the plaintext using rainbow tables. Especially so if hashed without a salt and using MD5.

Do you really think they implemented proper password hashing?