One of the things I have found is that often data (especially high-use data like passwords & usernames) is able to be snuck out through much more creative routes - storing in plaintext means extraction is much more worth the effort :) no waiting around to crack the data instant use.
I don't disagree it can be done, just pointing out that if we assume a compromised employee and a vector for removing the passwords, encrypting/hashing the passwords is like locking the side door of the stable.
But hashing the other data isnt practical - so it's the security vs. access tradeoff. You can hash passwords without much inconvenience.
Also with individual pieces of those other examples of data you mention it is not possible to gain access to the rest. Whereas with a password it IS. Damage limitation.
Finally the password and username (or email) are "front of the line". They HAVE to be accessible to an unauthorised client simply so said client can be authorised. Whereas the other data should require authorisation to access.
The reason we wouldn't have considered this to be a "major" security vulnerability is that compromising our database would already be a major catastrophe, so losing a few million people's passwords would be the least of our worries.
So for a bank, it's like the old joke about not needing to run faster than a bear, just faster than your buddy.
However, my guess is that 37Signals is a little different. We use campfire, but we do not discuss certain thing son it specifically because it is hosted on a 3rd party server. If 37Signals' database was compromised, we would be distressed to have our private conversations exposed, but we would be mortified if one of our developers' passwords was compromised and that became an attack vector into more sensitive information.
So I am suggesting it comes down to relative vulnerability. For a bank, a compromised database is a catastrophe whether it contains plaintext passwords or not. For an online chat application, a compromised database is not a catastrophe, but compromising user passwords might tilt the balance from inconvenient to embarrassing.
JM2C!