Andrew here from Black+White. Good spot.
Two sides of the coin on this one I guess. I have taken the prudent approach here and removed the password notification from the user sign-up email.
Also checked that the reminder sends a re-activation link with temporary password, not the original password.
Black + White