Well hopefully we can just use the same passwords* but I'm sure there will be a way to avoid phishing.

*Where did theymos state this?

To prevent people from thinking, "This is a phishing site trying to steal my password!", the primary method of resetting your password will be email reset. A secondary (maybe slightly-hidden) method will be to use your current password. So you needn't worry about having an invalid email address now.

A valid email address might be required in the new software, though. I'm not sure about that yet.