So, to put it into a nutshell:

1. they decided that some of their customers may have insecure passwords

2. to make these accounts more secure, they've sent the new passwords of all of these accounts in plaintext via unsecure email to the customers

3. any user that logs in with the new "secure" password can easily change it back to their old, "unsecure" password

4. before and while sending these emails, that very easily may have been considered as phishing emails by their customers, they haven't published any information about the whole process on their company blog, so their customers weren't able to verify the source and authenticity of these emails

5. after many users and blogs complained about the whole thing, they published a blog post stating in the end that "As always at WPML we are committed to learning from our clients", although the initial intention behind the whole thing seems to be that their clients should learn from them and set more secure passwords for their accounts.

Call me crazy, but I thought that a professional company - developing some of the most important, commercial wordpress plugins - does not require to learn from their customers how to implement a basic level of security, trust and professionalism...

As someone stated in the WPML support forum, with the above Facts in mind, it is at least questionable if they are able to maintain a decent level of security in all of their wordpress plugins...