If OpenSSH did ask for a password, it is no longer "rootme" and he wasn't setting it up for himself with his own password, I'll bet your friend just set the password to "password" ;]