Worked at a university dealing with this some years ago, the publishing companies blocked our IPs on regular basis because they had detected "hacked student accounts" Then we had to block them and swear they changed password before they unblocked us. They said that it was Chinese phising emails that tricked students to give up their password. If you dont know, a couple of years ago almost everyone accessed the publishers sites thought revese proxies at the school, so sci hub collected accounts and proxied you thought them, dont know if its still the case. We used this software called ezproxy, Think it was pretty common.

Also pretty sure many students gave away their passwords freely, based on that nobody seemed that surprised/worried when we said their accounts was compromised.