SpamReport: use new password API