For what it's worth, I have a BBC account in one particular name linked to one particular email account. It has one particular password.
They clearly keep them all, unencrypted, available in the same place, since I have had spam to that address, with that password as its header, and with that name in the text.
Luckily the spam was that old one about "oh you naughty boy, I have taken control of your machine and watched while you jerked off to those terrible movies you access, send me bitcoin or I'll send the tape to your whole address-book", which would have scared me more if 1) my machine had a camera or 2) I had an address-book in it. As it was I sat behind the a thorough fire-wall, Linux and no way the spam was in any way accurate, and laughed a little.
What was slightly concerning was that there seemed to be no way I could report this security-breach in their website arrangements to anyone at the BBC. It just ended up going round and round in circles through their "complaints" procedure, which does not did not allow any communication over a certain number of characters which was inadequate, or concerning anything outwith a few set complaints which they gave as a sort of multiple choice.
(The password etc works perfectly well for listening to something from R4 today; it just isn't allowing me access to the questionnaire.)