I haven't used Basecamp in a while, but I was distressed to discover this when screwing around with HTML in todo lists a while back.

I could put arbitrary JavaScript in the todo element, and I verified that it would execute when run by another user.

Combine that with plain text password reset and you just got pwnd bad.

This thread on the 37 signals site infers that the administrator of a Basecamp account has access to the passwords of that account's users. Stewart the project manager now knows your password and that of everyone else on his team...