On http://serverfault.com there's the question What would you do if you realized your email hosting provider could see your passwords? It's on-topic there, so it's unlikely to get migrated. However I feel the answers it could get here were more adequate, so may I kindly suggest those of you who feel like it head over there and leave an expert answer?
The answers left there appear to be very decent and target the question very well. They explained the possible reasons behind storing the passwords in a recoverable format, and they explained the possible responses to such matters.
The actual reaction is up to the client himself. They could leave their current ISP or simply use a unique password, which has already been mentioned in the answers and the comments.