#!/bin/bash
drush sqlq "UPDATE {users} SET pass = md5('pass') WHERE uid > 1;"
drush sqlq "UPDATE {users} SET mail = concat('myaddr+', replace(mail, '@', '_'), '@testdomain.org') WHERE uid 0 AND instr(mail, '@testdomain.org') = 0;"
These drush commands will set all users that are not anonymous or user 1 to password "pass" and sanitize all email addresses.
dustinc@getlevelten.com becomes
myaddr+dustinc_getlevelten.com@testdomain.org
drush has a --sanitize opt for sql-sync, and this code works the same way --sanitize works but will do it outside of synching a database.