I might miss something, but why is a password and account management page required for sending out email alerts?
I imagine it is because the logged user can simply check boxes to enable alerts on a specific product rather than inputing his email adress once again but the hassle is minimal with autofill.
You are correct. As well as unchecking alerts in the settings.
It seems that the solution to having a username/password is to make everything run from links via those emails, after they've confirmed. This may be worth exploring.
