Passwords reset after 'Pony' botnet stole 2 million credentials