I assume that he just grepped for the md5 hash of the common passwords he tried.

e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l