The Treasury Inspector General for Tax Administration has released While Progress Has Been Made, Managers and Employees Are Still Susceptible to Social Engineering Techniques (2005-20-042), also available on the Tax Analysts web site as Doc 2005-5571, 2005 TNT 52-6:

The IRS has successfully completed significant efforts in securing its computer network perimeters from external cyber threats. Because hackers are unable to gain access through these Internet gateways into the IRS, they are likely to seek other ways to gain access to IRS systems and, ultimately, taxpayer data. One of the most common tactics is to convince an organization’s employees to reveal their passwords. Along with user account names, passwords are needed to identify and authenticate employees before allowing them access to systems and data.

Under our test scenario, a hacker or disgruntled employee could obtain usernames and passwords to gain unauthorized access to the IRS systems.