If he used wget (or similar utility) he could specify password as a command line argument. It's not a very good practice security-wise but people do this sometimes.
This requirement is only for other vendors to get the certification from Microsoft. Microsoft itself does not need to conform to it, so it is still possible that their products will be locked.
Not only straightforward, but also not novel. For example such lists have been described (with source code) in this textbook (published in 1994): Taming C++: Pattern Classes and Persistence for Large Projects by Jiri Soukup. Here's a picture taken from this book illustrating the concept: http://community.moertel.com/~thor/blog/pix-20061201/soukup-...
