[Kushan]

Passwords are stored in plaintext, the agents can see your password on your account. There is no validation beyond what the agent thinks is "valid". If your password is "passw0rd1" and you tell the agent "It's pass word one", the agent might say that's ok or they might not. They should really be more careful than that but it's not a guarantee.

Do note however, your "account" password is not necessarily the same as your email password (which is stored properly and cannot been seen by agents, only reset).