I thought emails go in cleartext... so putting the password in the same email that has the moneypacket attachment would be dangerous. The sender needs to use a second communications channel to transmit the password.
Moneypacket is interesting, but I agree passwords in clear text is not such a good idea. What I suggested requires control of the email account. If I send 1 XMR to [email protected], the receiver would get an email saying he received a payment, and to log into his account (or create one) with that email verified. Obviously within the system you'd be able to link multiple email accounts or phone numbers that belong to you.
Am I missing something or can't you just use encrypted email?
Sure, but such a requirement would defeat the purpose of the service (accessibility to non-tech-savvy or privacy oriented individuals).
It's not necessary though, as eavesdropping alone wouldn't give you access to funds. Plus, being a centralized service allows for additional security measures that the normies love, like trivial reversals of in-network transactions.
There are many encrypted website style email services.