If I ever use the "forgot my password" functionality at a site and they mail out something that is probably my original password, I make a point of cancelling my account and sending them an e-mail explaining why I don't trust them any more.

And submitting the site to http://plaintextoffenders.com

Omg. That sounds like a public list of "Top poorly secured business sites to breach. --Reward guaranteed"

They have two classes of site that they don’t distinguish to be fair. One is the awful “You’ve forgotten your password. It’s: xxxx” where they’re just storing the password in plaintext in the database.

The other is still not great but it’s less bad: “Thankyou for registering. Your registered password is: xxxx”. In this case they’ve just passed the user details to an emailer before (potentially) encrypting and storing them.

Neither is good, but the first is awful.

Yeah. As a former employee, I will not recommend them to anyone who is looking for services in that particular arena.