If you’re writing a paper, I recommend citing real-world exfiltration incidents (from PS3 hacking forums) and performing a controlled test in a sandboxed environment to demonstrate the attack surface.
Explore free for up to 20 users. Save hours of admin time and simply get started with a password monitoring solution.