I agree it shouldn’t happen, but in this case, the programmer presumably made (more or less) the same mistake, writing out a variable called password unencrypted, possibly after copying it to a variable or structure field called passwordhint.

Thinking of that, this may be an example of a copy-paste bug (https://www.viva64.com/en/a/0068/), where the programmer wrote

   strcpy(&r.password    , &encryptedpassword);
   strcpy(&r.passwordhint, &password);

instead of

   strcpy(&r.password    , &encryptedpassword);
   strcpy(&r.passwordhint, &passwordhint);

(Hopefully using the safer strncpy, but that’s orthogonal to this argument)