When I was subbing for M$, number one rule was NEVER EVER email a customers password to them. Get on the phone, call and verify the customers ID and then give it to them. No exceptions.