Typically, they are sent in plain text and unencrypted. If you've ever transferred passwords by email, you've given the unauthorized receiver complete access if your email account is stolen. Unsecure passwords submitted through email frequently go via several servers and systems.