I think the email notification should notify the user that they will be required to have a password (or give us the option to put the password in the email by modifying the template or changing a config).
Also, it's not clear to the sender that the password is not in the email. Include some verbage on the upload/request screen so that they know they will have to let them know the password.