Yeah, I realy hate when that happend.
Once, we found the place that posted the password, sent an email to the affiliate manager with link to the site. I dont know if there is more we can do.
Then its upto the affiliate managers to take futher action.. they should banned their account.. stealing others work…