To be explicit: the attacker was given trusted access to the password database on another site and violated that trust. The fact that the site used poor security and that Jeff was stupid enough to use the same password in two places doesn't mitigate it.

I was expecting the answer to be that Jeff somehow revealed his real password publicly somewhere, not that this idiot stole it from a database that he had trusted access to.

This would be grounds for instant dismissal or even legal action in my book.