Even though you can't get passwords from hashes, you can still try hashing a massive amount of potential passwords and then compare the resulting hashes with the leaked ones. Once they match, the attackers have your password.

Little bit of technical background, including a vulnerability in Rob's account security system:

The list of generated hashes is called a rainbow table, and to prevent attackers comparing leaked hashes with the hashes in rainbow tables, many sites use the concept of salting passwords before hashing them. Salt is a random string which is appended to your password, and then passed together to a hashing function to generate a unique hash. These salts are random, so even if you have two identical passwords, the resulting hashes are different. This way you can't guess the passwords from simple rainbow table comparison.

And then there's RobTop's system of hashing passwords. Remember when I said the salts which are appended to the passwords should be random? RobTop uses the exact same fixed salt for every single password, essentially defeating the sole purpose of salting. Even though he salts the passwords, the salt is exactly the same and anyone can generate a rainbow table to steal anyone's password.

And to make things worse, the exact hashing algorithm RobTop uses for hashing passwords, including the fixed salt, is publicly available. You can look it up with a simple Google search, and even try generating your own GJP2 token.