I've heard from others that the passwords are stored in plaintext and viewable by support too, at least at some ISPs.

Now combine that with the typical user's tendency towards password reuse...