+1, the recovery code shouldn't go out in plain text email. Also, I picked a weak password just to quickly make an account and I can't seem to change it, hmmm.