When a user registers they are emailed a confirmation message. This message contains the user's password. This forces the security minded user to reset their password. Passwords should not be emailed except for password resets.
thanks for your feedback!
yup, you're absolutely right. this never should have been the default. i've fixed it in Item1728
, and that will be a part of TWiki-4.0.2