I guess because I saw it done.

What I saw was that the traffic was pulled out of the air using Kismet under the Backtrack Live CD booted on a laptop. The .dump file was saved to USB. The same laptop was then booted into Windows XP and a Windows program was run against the traffic, first to convert it from 802.11 to a .pcap file, and the same Windows program then provided full access to every account accessed via 802.11.

There was no keylogger involved. There was no access at all to the machines that originally accessed the accounts.

I am really now completely mystified by this whole thing. The password hashes under the accessed accounts are encrypted via SSL.