Agreed. I would hope that the first email was automated and nobody actually looked at the results of cracking the passwords. In the second week, you arguably had less expectation of privacy.