Comment by miorel

The proper response should be to expire the insecurely-sent passwords.