Very much this. The first thing you should be doing is making the password useless by changing it. Doing anything else is entirely irresponsible. Sure, remove

Very much this. The first thing you should be doing is making the password useless by changing it. Doing anything else is entirely irresponsible. Sure, remove the file in question after that... but you can't treat the old password as anything other than public knowledge at that point.