I'm glad you did post this as I have not really been following the CSM candidates after being dissilusioned after voting for Lark in the last one.
I now realise that my apathy could lead to someone like this guy being elected and so I'm going to read up on all the other candidates and use my 2 votes wisely.

Speaking for the UK and it's Laws, Galen is 100% correct. If the website does not invite comments, changes or submissions then changing its content or data is hacking. The fact that the password was insecure or even missing is irrelevant in the eyes of the law.