Researcher trawls cybercrime sites, collects billions of stolen credentials