Just for clarity, the "forgot password" flow emailed you the current password of the account (not a temporarily one)?

That's insane...