[syockit]

Can't reply directly to bart because the thread is too deep, but really, they do send it another e-mail. Don't ask me what it's supposed to achieve. Purportedly, if you sent the attachment to the wrong person, then you can remove the recipient when sending the mail containing the password if you happen to realize the mistake. Well, the thing is, (1) they usually send the password e-mail right after the attachment mail, which means it is highly likely they won't check the recipient list, and (2) they don't bother to use AES256 (because other Windows Explorer won't be able to open them), so even without the password it's trivial to crack.