Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had original

Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following: Hash(pw) + Hash(pw) := Hash(pw + pw) (NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.) But, I agree with many others here that the likelihood of stored plain text passwords is very high.