"Thus we created mechanism of extracting the information we need from the wallet to verify the password, but without actually sending the full wallet. "
In you wallet, not all addresses have budget. But they are still encrypted. So we can check the decryption phase with parts of the wallet that have no coins.
That part is based on trust. Most clients are happy enough that we have recovered their funds and are also doing their end of the deal. If there are to much clients not doing their end, then we will have to scratch the partial wallet deal. But at the moment we didn't have any client rejecting the fee.