they probably already have all the mapping for the old system stored somewhere the first time they have to switch to old reddit. Just need to change the behavior of that to return a 302

do you know how little that narrows it down?

the low-tech paper storage password still work pretty well in my opinion. As long as you don't need to use it all the time and the locks are secured enough.