No password is needed or used by most hacker bots. There are several different basic approaches. Even a cursory search of the internet will turn up a wealth of academic research papers written by faculty and graduate students from reputable major universities around the world on how to defeat any password scheme without knowing any passwords. Password cracking is a fertile field for PhD dissertation topics and the research is published freely and legitimately.
You will find a large number of hacker written "how to" articles and even the bots themselves openly for sale.
1Password is a fine utility, I use it myself, in addition to Keychain, but it primarily protects from identity thieves who already have direct access to my computer. It provides zero protection from attacks such as you have encountered. Most hackers have little or no interest in passwords because the seldom if ever use them.
