It is criminal malfeasance on management's part that any ID and password combination works after two months. Epic fail! When an person terminates their ID should be disabled and passwords to all accounts that person had access changed immediately. Passwords should also be changed on a regular basis not to exceed a fortnight.