In reply to Knut Sparhell.

sending passwords in email is a bad habit as all you need to do to get it is read access, and since emails are not encrypted every node in which it passes can read the password. For example if you use exchange then the admin of the server can read your emails, and same goes for google apps.

Getting password in an email is like putting it on a paper and trying to hide it.

As for how did they know the passwords are bad, this probably can be done without having the password in plain text by using some rainbow tables for a quick brute force attack against the account.