It is probably just a concatenated string of his credit card number or social security number and random words. I wonder if they are currently trying to crack it using some kind of dictionary brute force mechanism, or if there is some kind of lock out enabled after five tries.
I just recently implemented this. The thing I'm having trouble with is the fact that they don't limit the amount of time (or specify a limit, rather) which is acceptable to make the crawler wait. For instance, what if it take 20 seconds to load an acceptable amount of JavaScript-created HTML?