Report it here

http://www.usdoj.gov/criminal/cybercrime/reporting.htm

Trading of passwords is illegal. If people report it we can make a dent.

I use a program that stops all brute force hacking attempts, hotlinking, etc, plus another script that stops them passing around username/passwords and it stops that as well.

Emailing the host and telling them they are aiding and abetting a Federal crime ...