i like auctionsieve, it's cross platform :)

http://lcamtuf.blogspot.com/2011/02/world-of-hbgary.html

Linked in the above post is a link to the details of the attack, how hbgary got compromised: http://arstechnica.com/tech-policy/news/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack.ars

This one is easy:

It's just a matter of risk assessment, like anything in real-world security.

A generated password is better.

The chance is FAR greater that a person will chose a weak or reused password than that their email will be sniffed.

In a perfect world, it would be even better if the password is shown to them after signup over https and not emailed.