Sending clear text passwords in email might itself be in an issue. However, if all he wanted was to regularly send clear text passwords in email to the users, he still could have encrypted the passwords before saving it in the database. And when sending password to user, decrypt it while taking out of db and send it.