Did you get an email saying this, or did this happen when you logged in? At login they could examine the password you sent, check if it matched their hash, and then prompt you to change it.