My (admittedly dated) understanding of unix is that in /etc/passwd if the second field is 'x' then the identity can login with a passwd that matches a hash found in /etc/shadow.
However, when I list /etc/passwd I see that all the identities are marked with an 'x' including those that should not be able to login. In the /etc/shadow file, the no-login entities have a double bang "!!" in the hash field whereas the loginable users have the expected hash.
So, I presume this double bang convention is some alternative to the old (?) mechanism of using '*' to mark no-login users. Why is the old method no longer used?