Good question, as long as the password was not obtained through a stream or something of that nature like Norwegian said, I would personally not ban for it. By that same token the only thing that really has been stated time and time again is that, it's technically within the rules to join an unlocked group, then proceed to show up and kill everyone.