If it's a plaintext password, the minute it hits any human eyes, it is IMO compromised and the user should be required to change it. Employee, Interviewee, Hacker - doesn't matter.
I'd go a step further. IMO the second it hits a hard drive it's compromised so just the act of having that in the log would count.