Although, in their defense, what do you think most legitimate support emails from actual customers look like? This can't have been far off.

But still, their security process has a hole big enough to drive a truck through.

True enough. But yeah, definitely should've been a followup, one without the password to the account.