Quote:
Originally Posted by Gin 'n Tonic
I find it surprising that an email wasn't sent out.
Also this. Telling a user that their password has "expired" once they try to log in is absolutely the wrong way to inform them. A proactive approach, including sending a simple, informative email to all affected accounts is step one here.