There is no security breach because Stefan's code does not MD5 the "blank" password where vbulletin MD5s the entered passwords.

So even if you assign a blank password to all users, they wont be able to login by entering "blank" as password. They need to enter a password whose MD5'ed form is blank and there is no such password available.

So this is as secure as a "rock".. As a matter of fact so secure that nobody can login even if they know the password ;)

That's one helluva hack, but when I tried to squeeze into 3.6.3, it didn't fit - Too much of email.php has changed ...

Can it be adapted for 3.6.3? I could sure use something like that to reduce the email traffic of users getting frustrated with the "lostpw" process ...