Valentine actually dictated it, but it did actually happen. Brian's mail was something along the lines of, "I'm tired of reading about the latest security vulnerability in the NYT, so...". And I think it was six weeks, not a month.

Source: me, who worked there (in VS, not Windows) at the time.

EDIT: oh, yeah, forgot about the Gates mail. References are buried in this link: http://www.microsoft.com/security/sdl/story/#chapter-1

I stand by the B. Valentine version, just can't find a link.