There is more information and discussion on this topic at <a href="http://news.ycombinator.com/item?id=2150639" rel="nofollow">http://news.ycombinator.com/item?id=2150639</a><p>While I think the fact that Sourceforge is resetting passwords is useful, I think it would have been better communicated as a comment at the aforementioned link, as opposed to making a screenshot of an email message and submitting that.
I just got the email, too. I hate a lot of their interfaces and services (download pages, source browsing, search, mailing lists... lots of lame) but I'm glad they're jumping on the problem proactively.