Plain-text, unencrypted passwords were sent instead of having users reset them. There was no breach, the firm claims, but how would it know?