I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser...

I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally. However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints. Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is much more appropriate to follow up with the appropriate party and at least give them a chance to respond before sounding the klaxon.