Dumb bug of only the week is being fairly generous
An alternative suggestion as to the source however: when one uses Apple's interface builder, one task is to connect outlets to graphical elements, e.g. you know there's an NSTextField that the user will type a password into so you declare an NSTextField property and then you switch to the interface builder where you have laid out the dialogue and you wire the property to the control — literally drag a connection from the one to the other. Then in code you access the text field's contents via the outlet.
A drag and drop error that connected both the 'hint' and 'password' outlets to the password text field would then result in the password being recorded as both, even though the code says 'self.password' for one and 'self.hint' for the other. And the wiring is all within the undocumented XML format used for interface layouts, so good luck getting a meaningful code review on that.
Given the whole purpose and importance of a password hint, it's mind boggling that nobody tested the feature.