Indeed, regardless of how you choose your passwords email is a huge target. It's good to see Google and Facebook trying to thwart this by adding account activity information, etc.
Every few weeks I go to gmail and search the term "password" as well as some of my more commonly used passwords and permanently delete those messages. I'm forever annoyed when a service sends me my password via email.