Absolutely. And, I can't think of any email service that sends passwords in clear text. I'm not convinced it is this easy to compromise someone's email account.
What I was thinking about was someone using say POP and a client like Thunderbird. The POP traffic by default is clear-text, so when you send your password to the server, it's in the clear unless you're either tunneling your traffic or going to a secure port to your ISPs mail server.
This is sadly true. I cannot connect to my school's e-mail service with either of the security schemes provided by Thunderbird (SSL, TLS, or STARTTLS). The trade-off is a nice program versus a secure connection.
I'm not exactly concerned about the security of my school account, but it could potentially suck to have it compromised.