on the email password page, look for the line that sets the send mail, it will look similar to:
$WA_MailObject = WA_SecurityAssist_SendMail($WA_MailObject,"","","",$WA_Auth_Parameter["toAddress"],"",$WA_Auth_Parameter["fromAddress"],$WA_Auth_Parameter["subject"],$WA_Auth_Parameter["mailBody"]);
you can add the BCC to the 3rd argument and the CC address to the 4th:
$WA_MailObject = WA_SecurityAssist_SendMail($WA_MailObject,"","bccaddress@domain.com","ccaddress@domain.com",$WA_Auth_Parameter["toAddress"],"",$WA_Auth_Parameter["fromAddress"],$WA_Auth_Parameter["subject"],$WA_Auth_Parameter["mailBody"]);