I guess Bluehost doesn't have any auth scheme so they had to use the age old workaround of just sharing passwords... not great at all.

Also, you missed the fact that there's a typo on that line at the very end!

> Your password for Bluehost (double check that you spelled this right!)e

There's also the line above the password part:

> Once you've purchased your hosting - forward the confirmation email you received to: team@startablog.com

Which since I don't have I can't confirm if it has any sensitive information or not.