Why did you not even send a warning mail to all addresses? Thousands of casual forum users don't even know about this incident and their password hashes stolen.