[Opserty]

The whole point of the loops are there to stop people from accessing it who shouldn't be.

All good pieces of Internet software will NEVER send you your password directly in an email. Not only is it not sercure to save a plain text password in the database (say for example you give another admin access to your site, they can run a simple mysql to fetch all the password of the users and then maybe test them out with their email accounts to see if some users use the same password for both. If they do...voi-la they have access to users email accounts. Its unlikely but its an example of what can go wrong.

On the other end: say a someone (A) gains access to a users (B) email account, maybe they guessed their secret question, if B has archived their activation email in their inbox then (A) can see they have signed-up to your site, so they come to your site clicks the forgotten password link and an email is dispatched to inbox of B and A can read it...now they have a password they can go try it on all the sites they can see in the B's inbox. If they are "un-intelligent" enough to sign up to a site that stores passwords in plain text then they probably use they same password for everywhere else they are signed up to.

Both are rare situations but they are both plausible. From a personal point of view I would sign up to a site that has my password stored in plain text. (I test anything thats not vB for I add details )

There are probably more reasons too but those a just some quick ones I knocked together.