Password sign-in is a testing stub, not authentication: any address plus one shared password signs in as that person, and nothing verifies who you are. Microsoft sign-in above is the real one. Turn the password form off in Admin → Sign-in once you trust it.