When creating a new mailbox, the formfield for setting an initial password is not of type password but of type text. Hence, the browser will store the password as clear-text.

The formfield should be changed to type password.