The proper response should be to expire the insecurely-sent passwords.