Just because it was sent by email, doesn't mean they aren't encrypting passwords. When the password is sent to their servers it's unencrypted anyway so can be read and sent in an email. I do disagree with passwords being sent by email though
For number 3, no they aren't for forked repos. See mine - https://github.com/deanperry - my popular repos aren't ones I've forked. I have quite a few forked repos which have been starred loads of times.
Wow this is great GitHub. One of my fave features so far. It was always a pain to see my most popular repositories and to view the repos that I have contributed to!
Well the SSL certificate isn't valid so that's not a good start!
I also use PointHQ.com and have been for about 2 and a half years now. Brilliant service. Built by the guys at aTech Media who make Codebase - http://codebasehq.com and a few more useful apps =]