People use POP email at work all the time. I can see their plaintext passwords coming through the network monitor (which it's my job to review), and I've seen some patently offensive passwords being used. This brings up two of your points: First, I ignore the fact that I can see their username and password. The responsible thing to do is to completely forget that you can see it. I have no business with their login information. I'm completely aware that the only thing I can do with this information will cause damage to myself and to the person who unwittingly gave me this information. Secondly, I ignore the words on the screen. Because it's not something that was designed for me to see in the first place.

Shouldn't you advise them to use POP over SSL?

We can advise them to use whatever we want, the trick is getting them to listen. Our corporate email disallows POP, but we aren't in the business of blocking their personal email on our non-secure network.