Comment by dahauns

>Once you've decided to send the actual password,

But you haven't. Microsoft has decided that for you - without telling you.

The more I think about it - that's not even just a GDPR issue, it's blatant malware behavior.