ruh-roh, looks like a breach in the WP plugin repository. they jumped on it quickly. http://wordpress.org/news/2011/06/passwords-reset/