I think it's a nonzero chance they're not hashing it. Pretty much every hashing function, in the interest of preventing collisions, provides vastly different responses on small amounts of input. Even if they were hashing it, it would just appear to be the same password in a situation where they somehow got a collision, but again, the column length for passwords would always be fixed since a hash function always outputs the same data length.