You’re liable if someone shares their credentials? Even if they did it accidentally by installing a keylogger, that seems like user error.