We talked about this for a while and decided that, at least at first, we want to lock out the original owner. The reasoning behind this was that their actual p

We talked about this for a while and decided that, at least at first, we want to lock out the original owner. The reasoning behind this was that their actual password is compromised. We want to make sure that the user understands this fact and changes their password. Not only on our service, but on all the others that they may be using the same password for as well. The email does say that someone else has your password, but if you can just ignore the email then most will not actually get it or assume it's some kind of phishing email.