It's easy to write a plugin that would measure the strength of users passwords. You just intercept the $_POST variable when users log in.

As to emailing only customers who had weak passwords, I received this email and my previous password was something like "Mf7JU!eP43ps". Not fantastic, but hardly weak.

I don't see a problem with emailing customers passwords, so long as you insist that they change the password after log in. But you're right, a password reset email would have been much better.