That's a good point and that's why we recommend that the user change his password after they get a new one by email.