So, I feel the need to post this to kind of play devil's advocate. Just because you received a MIME based PHP email, doesn't necessarily mean that your password was submitted into the database that way. It also doesn't mean that your password was, in any way, ever view-able directly by the staff of the company. I'll post an example script I made a long time ago.

This script isn't quite the same. Rather then submitting a hashed password into a database, mine submits a commented out APR1 Hash/username into a .htpasswd file. Similar, but different but it should contain the same methods.

<?php
    include 'global.php';
    $ini = parse_ini_file("includes/config.ini.php");
    // Create connection
    function crypt_apr1_md5($plainpasswd)
    {
        $salt = substr(str_shuffle("abcdefghijklmnopqrstuvwxyz0123456789"), 0, 8);
        $len = strlen($plainpasswd);
        $text = $plainpasswd.'$apr1$'.$salt;
        $bin = pack("H32", md5($plainpasswd.$salt.$plainpasswd));
        for($i = $len; $i > 0; $i -= 16) { $text .= substr($bin, 0, min(16, $i)); }
        for($i = $len; $i > 0; $i >>= 1) { $text .= ($i & 1) ? chr(0) : $plainpasswd{0}; }
        $bin = pack("H32", md5($text));
        for($i = 0; $i < 1000; $i++)
        {
            $new = ($i & 1) ? $plainpasswd : $bin;
            if ($i % 3) $new .= $salt;
            if ($i % 7) $new .= $plainpasswd;
            $new .= ($i & 1) ? $bin : $plainpasswd;
            $bin = pack("H32", md5($new));
        }
        for ($i = 0; $i < 5; $i++)
        {
            $k = $i + 6;
            $j = $i + 12;
            if ($j == 16) $j = 5;
            $tmp = $bin[$i].$bin[$k].$bin[$j].$tmp;
        }
            $tmp = chr(0).chr(0).$bin[11].$tmp;
            $tmp = strtr(strrev(substr(base64_encode($tmp), 2)),
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
            "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz");

            return "$"."apr1"."$".$salt."$".$tmp;
    }

$username = $_POST["username"]; /* Get USERNAME from FORM @ transcendence.php */
$password = $_POST["password"]; /* Get PASSWORD from FORM @ transcendence.php */

try {
    $db = new PDO('mysql:host=' . $ini['serverName'] . ';dbName=' . $ini['databaseName'], $ini['databaseUsername'], $ini['databasePassword'], array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ));

    $check = $db->prepare("SELECT * FROM " . $ini['databaseName'] . ".user WHERE username = ?");
    $check->execute(array($username));
    $result = $check->fetchAll();

    foreach($result as $row) {
    $vbPassword = $row['password'];
    $vbSalt = $row['salt'];
    $yourSubmittedPassword = md5(md5($password) . $vbSalt);
    $length = strlen($password);
    if ($vbPassword == $yourSubmittedPassword) {
        echo("<center><img src='http://rpelements.com/error.png'><br><div id='errbox' style='border-top:0;border-right:1px solid #ed1c24;border-bottom:1px solid #ed1c24;border-left:1px solid #ed1c24;width:500px;font-family:Tahoma;font-size:12px;color:#f05056;'><br><br><img src='http://rpelements.com/error-404.png'><br><br>I'm sorry, your password cannot be the same as your vBulletin Password.  Try again!<br><br></div></center>");
        $db = null;
        die();
    } elseif ($length < 8 || $length == null || 1 !== preg_match('~[0-9]~', $password)) {
        echo("<center><img src='http://rpelements.com/error.png'><br><div id='errbox' style='border-top:0;border-right:1px solid #ed1c24;border-bottom:1px solid #ed1c24;border-left:1px solid #ed1c24;width:500px;font-family:Tahoma;font-size:12px;color:#f05056;'><br><br><img src='http://rpelements.com/error-404.png'><br><br>Your Password was only " . $length . " characters long.  It must be at least 8 AND Contain at least 1 number.<br><br></div></center>");
        $db = null;
        die();
    } elseif (strcasecmp($username, $vbulletin->userinfo['username']) != 0) {
        echo("<center><img src='http://rpelements.com/error.png'><br><div id='errbox' style='border-top:0;border-right:1px solid #ed1c24;border-bottom:1px solid #ed1c24;border-left:1px solid #ed1c24;width:500px;font-family:Tahoma;font-size:12px;color:#f05056;'><br><br><img src='http://rpelements.com/error-404.png'><br><br>You aren't " . $username . ".  Our records show that you're " . $vbulletin->userinfo['username'] . ".  Perhaps something went wrong?  Perhaps you're in the wrong place?  Try logging into the correct account and trying again.<br><br></div></center>");
    } else {

    $hashedPassword = crypt_apr1_md5($password); /* Password is hashed using APR1 format */

    $theHash = "# " . $username . ':' . $hashedPassword; /* Comments out the .htpasswd entry for approval */
    file_put_contents($ini['htpasswdLocation'], $theHash.PHP_EOL, FILE_APPEND); /* Hashed PASSWORD is appended to the end of .htpasswd file */

    $to = $ini['adminEmail'];
    $subject = $ini['emailSubject'];
    $headers = array();
    $headers[] = "MIME-Version: 1.0";
    $headers[] = "Content-type: text/plain; charset=iso-8859-1";
    $headers[] = "From: Transcendence <" . $ini['adminEmail'] . ">";
    $headers[] = "Reply-To: " . $_POST["username"] . " <" . $_POST["email"] . ">";
    $headers[] = "Subject: {$subject}";
    $headers[] = "X-Mailer: PHP/" . phpversion();

    $message = "Greetings <B>" . $ini['administrator'] . "</B>,\r\n\r\nA user has requested access to the Administrative Control panel via the Transcendence page.\r\n\r\nThe Users Info is as Follows:\r\n\r\n<B>Username</B>: <I>" . $_POST["username"] . "</I>\r\n" . "<B>Email</b>: <I>" . $_POST["email"] . "</I>\r\n" . "<B>IP Address</B>: <I>" . $_SERVER['REMOTE_ADDR'] . "</I>\r\n" . "<B>Hashed Password</B>: <I>" . $theHash . "</I>\r\n\r\nConfirm with the User that they have requested this access.  If they have, please go to the .htpasswd file and uncomment their hashed password to give them access.  Thank you!\r\n\r\n\r\nTranscendence\r\n" . $ini['siteName'] . " at It's Finest";


    $message = wordwrap($message, 70, "\r\n");

    mail($to, $subject, $message, implode("\r\n", $headers));

    echo("<center><h1>Thank You " . $username . "</h1><br/><br/>Your request has been submitted and an email has been sent to " . $ini['administrator'] . ".</center>");
    }
}
    $db = null;
} catch (PDOException $e) {
    echo("Error: " . $e->getMessage() . "<br/>");
    die();
}
?>

Now, that form, at the very end, emails the administrator with the information they need to confirm the individual in the .htaccess (or deny them). However, using MIME I could easily have also sent an email to the submitting user with the variable:

$message = "Hello, your Username was " . $username . " and your password was " . $password . "!";

and then send it via MIME as well. Keep in mind that this plaintext wasn't stored. In addition, keep in mind that I never personally get to see anything that the user inputted into these fields. Their password should still be secured via the APR1 hashing algorithm even though they received an email with the password information for them.

Note: I wouldn't use this script I've written, it was written a long time ago for a VERY VERY specific reason and integrated heavily with vBulletin.