The theft of a PowerSchool engineer’s passwords prior to the breach raises further doubts about the company’s security practices.