Thus proving, if they can read, they can spy...

"Password guessing is hard work. Why not just sniff credentials off the wire as users log in to a server and then replay them to gain access? If an attacker is able to eavesdrop on Windows login exchanges, this approach can spare a lot of random guesswork. There are three flavors of eavesdropping attacks against Windows: LM, NTLM, and Kerberos.

The most capable of these programs is Cain, which seamlessly integrates password sniffing and cracking of all available Windows dialects (including LM, NTLM, and Kerberos) via brute force, dictionary, and Rainbow cracking techniques..." (more)
Excerpt from the 10th anniversary (6th edition) of Hacking Exposed, published by McGraw-Hill/Osborne, "The World's Best Selling Computer Security Book." That's a lot of spy potential.