I guess the intent behind this law is to make it easy to get to the other accounts on different services that a user might have due to people using the same password for lots of things.

So, upon receiving a request for this you could generate a random password and give that to them (as well as set the user account to this password). They have no way of proving that this isn't their password :)