If you forgot your password for a website and you click [Forgot my password], sometimes the company sends you a new password by email but sometimes it sends you your old password ny email. Compare these two cases in terms of vulnerability of the website owner.