Exactly! That's what i thought. Mailing a password to a user on changing it is maybe not the safest, but it does not mean it saves it plaintext to the database. They can just send out an e-mail when updating the password to the database and then never use the plaintext version anymore.