In list most popular pools, i can add any pool on mpos ( ° ͜ʖ ͡°)

i have checked all of my pools in this list and it looks to me like the OP has used a bot or manually generated accounts and then somehow has the details there, i can assure you all passwords and pins are hashed and salted in MPOS both by default and in my configs.

An example of this is coye.cryptopools.com. the pool doesnt exist since i fell asleep before the launch so it goes to show the details are fetched from another location.
Another example is ftc.d2.cc it shows a username clicking login takes the user to digitalcoin.scryptmining.com

it looks me like the creator of the app is sending the login details via HTTP POST as a normal user would which allows people to access these fradulent accounts they have made under false pretenses

no doubt they may be legit accounts but i believe 1/2 are fabricated accounts, 1/2 are accounts with weak passwords which the OP has guessed.

Reusing passwords on multiple sites in 2014 

That's all this is, a db dump with a front end and a few cracked passwords.

I think they are bruteforcing easy passwords, I use very strong random character passwords on all my pools and got notifications about xx failed login attempts on a few pools.