I'm not sure I understand the part about keeping the password secret, but I otherwise agree with your strategy. Or you could just have the order read that confirmations should be sent via e-mail in the first place.