In most cases the username will be available in $document->username. Check for the existence of the property before using it, or prefix with an @ symbol in case it is not defined (only likely to happen when emailing directly from the invoice list using the envelop icon, but I will amend it to include the username even in that case for the next release).
The only time the user password is available is when an order form is submitted containing a password field. It is not included on order confirmation emails any more as I had some complaints about the security implications of that, however, you can login to the admin side and check the order record to see the password that was entered. Once a user record has been created, the password is hashed so cannot be decrypted.