"Should not" be compromissed? This doesn't sound very re-assuring. Either it has been or it hasn't been compromised. I would appreciate a clear answer once you guys got some more information.
Email addresses are stored in clear text, but no data was downloaded from the server. Everything else is either encrypted, or not stored on this server.
How'd you confirm encrypted passwords weren't downloaded? They'd be stored with your SQL most likely, and DBs could have been grabbed at top level as well.
No activity on the database server (different machine); however, as a matter of prudence it is always a good idea to not reuse passwords of different sites.
