He can brute-force it. Try guessing until the hashes match. With a reasonably short password and a fast machine, he may crack it in under a year. (Only to find that he was cracking the wrong thing )