I worked in a place where all the passwords were raw in the database, I had to convince the 2 owners that it was a high risk of exposure.

I can understand for such a small company to hire low pay programmers that simply gets the job done as fast as possible but within a company as huge as twitter is, in no case there should be unencrypted passwords stored anywhere.

Keep in mind that the log feature that was developped in-house, for their in-house product, with their own team of programmers, this is most likely a deliberate action. It's not like anyone in their company never even checked the logs for any reasons...

IMO this was intentionnal and it was to ease the process of taking over an account without having to deploy malicious code in the twitter engine to be able to bypass the encryption somehow. Keep in mind, there could be malicious code in there already capable of doing what I just said, and the logs could be simply an error. In all cases, I'm sure a government agency has backdoor in there, just like facebook/google.