The following comment just showed up in my activity:
He may have just phrased that clumsily. The out-of-the-box membership provider will reset a password, not resend it. I agree that sending the original password would be a security hole.
I probably wrote that -- it sounds like me -- but not recently. But the timestamp on both the question page and my recent activity shows it as three hours ago, when I was asleep.
So I think there's a bug here.