Interesting, and completely undocumented as far as I know.
This will not answer your question but might give some ideas whats going on.
The default Administrator account password is a plain MD5 hash:
password = 5f4dcc3b5aa765d61d8327deb882cf99
However, the new users don't get plain MD5 hashes. The key length is the same so I guess this is still MD5. So either the input modified before hashing, or the MD5 algorithm for the new accounts runs slightly different, like multiple passes. Or a combination of both. I think the first option is the correct one.
The user accounts lack an individual salt. So if you have multiple users with the same password, the hash will be the same.
Here is my theory of what is going on, would be great if any dev could confirm this:
password -> passwordSecretKey123 -> default MD5 Hash algorithm -> output hash
monkey -> monkeySecretKey123 -> default MD5 Hash algorithm -> output hash
toaster -> toasterSecretKey123 -> default MD5 Hash algorithm -> output hash
So in theory, if you could only acquire the "SecretKey123" part, it would probably be pretty easy to come up with an authentication solution.
