Well I know that but don't you have to enter the username of the user who wants to be whitelisted?
Cracked users have usernames.
When a user joins the server, they're required by xAuth to register a password for that username.
Since online mode is set to false in the properties, the server doesn't query minecraft.net to make sure it's *actually* that registered user.
So, users are able to connect to the server with a reasonable amount of security without being connected to minecraft.net.