#!/bin/bash
 
drush sqlq "UPDATE {users} SET pass = md5('pass') WHERE uid > 1;"
drush sqlq "UPDATE {users} SET mail = concat('myaddr+', replace(mail, '@', '_'), '@testdomain.org') WHERE uid <> 0 AND instr(mail, '@testdomain.org') = 0;"

These drush commands will set all users that are not anonymous or user 1 to password "pass" and sanitize all email addresses.

dustinc@getlevelten.com becomes myaddr+dustinc_getlevelten.com@testdomain.org

drush has a --sanitize opt for sql-sync, and this code works the same way --sanitize works but will do it outside of synching a database.