It does.
They will have to wipe it before re-using it... however, that wont guarantee some dodgy kid doesnt go through it first. Windows passwords are a joke. Unless you turned on encryption they can see what they like.
All they do is re-image the disk, effectively wiping it. A specialist could still access some previous content.
As for the charge, the data protection act speculates that companies can charge a 'reasonable' fee for return of such things.