Should BCC see username/pass or tags

I've been testing account reminder -and wondering if this is the correct behaviour.

As the admin, I've set it up to send me the messages in BCC, but when I recieve them the variables are all tags. Is this to protect the user from me seeing the password, or is this not working as intended?

Example of email:

%username,

This is a reminder from %site. You have registered for a user account but have not yet validated your email address. To fully activate your account at %login_uri login using the following username and password:

username: %username
password: %password

You may also log in by clicking on this link or copying and pasting it in your browser:

%login_url

This is a one-time login, so it can be used only once.

-- %site team

This email will be sent 3 times. You can stop receiving these reminder emails by either activating your account, or using the unsubscribe link below:

%unsubscribe_url