... it's insecure; any combination of mailservers & infrastructure between the email leaving her and getting to her folks could've read it, or stored it to read later. This is just the kind of thing it turns out the NSA is collecting!

Realistically, this happens all the time, it's not very likely she'll suffer identity theft. If you're in america I think you can do things to freeze your credit if you believe you're at risk of identity theft etc. I think that could be an over-reaction for this.

Just tell her that next time it may be better (at the very least) to use an encrypted zip and SMS the password. (I know encrypted zip isn't great, but almost anyone can deal with them)... even the average lay person. The later versions offer not-so-terrible encryption.

... it's insecure; any combination of mailservers & infrastructure between the email leaving her and getting to her folks could've read it, or stored it to read later. This is just the kind of thing it turns out the NSA is collecting!

Realistically, this happens all the time, it's not very likely she'll suffer identity theft. If you're in america I think you can do things to freeze your credit if you believe you're at risk of identity theft etc. I think that could be an over-reaction for this but may not hurt.

Just tell her that next time it may be better (at the very least) to use an encrypted zip and SMS the password. (I know encrypted zip isn't great, but almost anyone can deal with them)... even the average lay person. The later versions offer not-so-terrible encryption.