The other answers are fine, but there's an at least theoretical second possibility which you touched on in your question and which bears discussing. (This is totally obvious to the security paranoids out there, but maybe not everyone else.)
If the "you have a weak password" message did not come from the site it claims to, and if the sender of that message -- who is actually an outside attacker -- has a way to eavesdrop on, and is lurking there waiting for you to, log in and reset your password as requested, then boom, he's got his hands on your new, "more secure" password (even though he may not have had any idea what your old password was, or how weak or string it was).
How could an attacker eavesdrop on your password reset session?
* compromised the part of the site that accepts password change requests
* sniffing your Internet connection somehow
* gave you a helpful link in the email which points at a different site that mimics the real site
@darnok mentioned being careful about exactly the right two things:
- verified that "the email seems legit"
- noted that the email did not have a convenient link, that the suggested action was to "log into your account and go to account->account details to change your password"
But, these days, if you get such an email, I'd say you're right to be concerned. If you were the victim of a well-resourced attempt to steal your password, this is exactly what it might look like.