The researcher later found that passcodes he tested weren't always counted.