Not against the rules, no.
Is your problem that it happened, or that you don't trust the person who did? Would you still expect action taken if it were someone you know and trust?
If allowed my fear is someone claiming it is for good "to stop hackers" and just collect accounts. I'm guessing a list is made of usernames and passwords. I guess I don't like the idea of someone being able to claim being a good guy when making a list of accounts and passwords.
And what would you suggest be done about it? Say "no, you can't do it"? Not going to stop anyone is it (good or bad)?
I guess it's true. I can see how it's a crappy situation no matter which way you go about it.
I have been thinking about it but everything seems to have a downside. Best would be able to run a script that looks for emails/username in database and changes password if on it, and emails a reset password email. But the big problem is the people who did not use a real email. So causes a headache still.
I guess noting can really be done except hoping users start to use different passwords. Seems to be only easy/simple way to keep this from happening.