Client receives the Attacker's packet, and now assumes a plaintext password should be used. Client receives the real packet from the server, but ignores it thinking it is a dupe. Client sends the password in plaintext. Attacker grabs the password and now logs into the Server directly. Client times out or gets an error, and figures a network error has occurred.
Client tries to log in again.
It is also possible in theory to catch the session before the authentication process even starts. Attacker sees this request, and forges a reply that the Attacker's IP address is the address for the host the Client is requesting. Attacker sends request to DNS server cancelling Client's request. Client starts to log into Attacker. Attacker tells Client to send the password as plaintext.