By default the notification text for invoice notications contains the following line :
For security reasons, your statement is password protected.
To login in, you will need your user name: $username and your account password: $password
However what gets added to the velocity model is the hashed password. Adding the hashed password to the model makes very little sense, including it in the email makes even less sense