I replaced one of the DLLs (winmm.dll?) with a DLL of my own. It got loaded before the login dialog and installed a hook that saved your login details to a file. This was Windows for Workgroups so no access controls for files.
That way we managed to get the login info for a teacher that nobody liked, then we filled his home directory with porn. IIRC there was a quota of 5 MB and after that the admins got involved.