So I install eCart and did not get the error. BUT the email that's sent has the encrypted version of the PW not the unencrypted one. I don't think I'm missing any steps.
Although I've run through this a few times could it be that something is stored in a cache somewhere? The variable names, newPW or newPassWord, keep appearing.