NaN

The one they were sending at registration was prior to hashing. It would not be reversible afterwards.

An issue if you’re reusing passwords. If not, every forgot my password email is also vulnerable.

A combination of bad practices could be… bad.

Edit: apparently around the same time, their forum was also lacking https. This would be an even easier vector.

They have said it is being hashed for storage: https://forums.larian.com/ubbthreads.php?ubb=showflat&Number=669268#Post669268

I can’t fault the OP though, if I received such an email I would assume it is stored in plain text and be similarly upset.