Well, at Telkom, when you signup for an account, they fax it to you, so it's written in plain text on the fax before they send it.
At other ISP's they email your username/password combo, unencrypted.
While it's sitting in your mailbox on a mail server, any admin can snag it.
Heck, it's even possible to write scripts which specifically scan mailboxes for it, assuming your a dirty rotten admin of the mail server - they do exist !
A router can also be hacked, but it's unlikely - it's usually the easiest just to get hold of the user/pass combo from an email/fax.
Personally, I think there should be a way to associate your ADSL account with your phone circuit number, to prevent this type of thing from happening.