System password authentication

I am currently in the process of implimenting pam authentication for
cvs and I came across this code:

    if (*found_passwd)
        {
        /* user exists and has a password */
        host_user = ((! strcmp (found_passwd,
                                    crypt (password, found_passwd)))
                         ? xstrdup (username) : NULL);
            goto handle_return;
        }
    else if (password && *password)
        {
        /* user exists and has no system password, but we got
           one as parameter */
        host_user = xstrdup (username);
            goto handle_return;
        }
    else
        {
        /* user exists but has no password at all */
        host_user = NULL;
            goto handle_return;
        }
    }

The "else if" here authenticates a user if she has supplied a (non blank)
password but the system password is blank, Why?

/Brian