Very much this. As a long-time Namecheap customer, this thread caught my attention, but my layman's conclusion is that it doesn't really sound like they did anything worse than any other host would have done.

As someone who forgets his passwords on a regular basis, I'm kind of glad that there's no such thing as perfect security...