That's not quite true, most random web services send out the welcome email from the same page that just hashed your password so during email creation they still have the plaintext copy around even though it dies after the request ends.