This kind of thing can often be hard to catch in a code review, because often it's the combination of several systems that cause this to happen. Tracing the user's password from submission form all the way to logger would probably require jumping through several layers, most of which are just handed black box blobs that they hand to the next system.