If you account hasn't been accessed in that time, there is nothing to be afraid of.
IMO, this is reflective of a corporate culture that places testing and security on the back burner. And while some people may be OK sending their data to such a company, the rest of us might not be.