What I said to John:

I hope this email address still works for you. I searched my email under your aol address, and couldn't find a message from you.
There are a lot of antivirus programs that are sending people warnings about their Mudcat password being compromised, and some people get all out of sorts about it. One man even left Mudcat because he didn't like the idea that I had to change his password on his request and would therefore know it. Mudcat passwords are not the same as bank passwords, and therefore do not need to have irontight security. Your Mudcat password is like the lock on a bathroom door, not like the combination lock on a bank vault. Your Mudcat password simply identifies you so you can send personal messages, identify yourself with credibility on posts, and use certain other services that need to identify you. But Mudcat is a place for exchanging words, not bank information and not binary information that could carry malware. We allow users to submit text, and only text - that keeps us simple, safe, and reasonably secure.
I'm glad to change your password if you want me to, but it's not likely to make any difference and then you'll have yet another password to memorize. If you want yours changed, email me the new password you'd like. If you can, email me from the email address you used when you became a Mudcatter. If you no longer have that address, at least tell me what it was. Otherwise, I may need to ask you a few questions to ensure it's you. We use a human form of two-step verification. That's why people have to go through me to join Mudcat or to change their registration information. The guy who left Mudcat thought it better to trust a machine to change his password, not a human.