The only way to transmit credentials, I believe, unfortunately, is via out-of-band communication, e.g. sms/IM/phone/face-to-face. Not exactly convenient, but if

The only way to transmit credentials, I believe, unfortunately, is via out-of-band communication, e.g. sms/IM/phone/face-to-face. Not exactly convenient, but if you need the message to stay secure from human adversary, it is probably the only way. If your adversary is a machine (your peer in gmail is in control of his/her account, and is not wiretapped by an actual human/you simply don't want google to feed on your emails/you are not an enemy of mossad), a captcha would probably do, along with something like we see in email verification links.