So they are picking up passwords for email accounts?
Google accounts, which includes their email.
Clinton's campaign is using Google Apps, which hosts email, shared storage, document editing, etc. for a corporate workgroup.
I haven't used my Google email for awhile -- their spam filter wasn't working well, and I switched to iCloud. But, I enabled two-factor authentication long ago: after entering the password, a 6-digit number must be entered, using the Google Authenticator app on my phone.
I don't know if it would have prevented this fake page from reusing the credentials at that moment, but it would have prevented the credentials from being reused afterwards.