If you can SET_TEXT, you can probably also get text. I've heard stories of win32 "password stealers" that constantly loop through all the window handles on the system looking for password fields, and if one is found, they log the contents of all nearby text fields (to get the username) and the password field to a file.