If a hacker can steal your user database they as-likely-as-not have access to your reversible encryption keys.

On top of that it's bad form to mail a user their plaintext password back to them.. I don't need my password crossing third-party networks and SMTP servers in plaintext.