The fact that he recognized sending a password back to him in plaintext is something noteworthy means he's a least not as dumb as the average luser. :P
Anonymous
He just messaged me like "Is it normal for a website to send my password back?" - I said, was it when you just signed up asking you to change on login? (Still not good really) and he said - "No i've had the account ages I just cancelled something and it sent my password back to me"
Anonymous
I think it was more the fact hes never seen ti before.
It's sad how many sites don't take security even remotely seriously. I mean here we are saying "use bcrypt use pbkdf2 blah blah blah" and we get all pissy when a site uses a plain, single-iteration hash (or god forbid, an unsalted hash) while there are websites that don't use any hashing...