[101008]

Honest question: If you send it on the email without storing (just sending appending the $password variable to the email body), what would be the problem?

[UncleMeat]

Some email is still sent unencrypted over the web so people snooping on traffic could see it.

[GoblinSlayer]

Not hypothetical https://plaintextoffenders.com/post/628974096028434433/movis...

[thedanbob]

Any mail server the email happens to pass through is able to read/log the entire content of the message.