My guesses would be that either:

• They conducted an employee survey where someone admitted the company name being a substring of a password they use.
• They used some rudimentary bruteforce methods which matched salted registers or logins (say "Company name123456".)
• Instead they meant that it is possible to create passwords with the company name in it, but transmitted it poorly.
• Some of the passwords are unsalted.
• The passwords are logged somewhere else.

It goes without saying that if they found a vulnerability with the hashing or salting, it should be highlighted on its own, and in any case it wouldn't do damage to ask them directly.