The password is transmitted from the web server of the website to the SMTP server, so Joe Public cannot see it since he is connected to the web site via another path.
As Joe Public, all you can see is the web page source or data traffic between your browser and the website server (if you use a packet sniffing tool such as WireShark).
