Ask him what protection program he is using...is it Net Nanny?
IE by itself doesn't really have a P/W protection from popups and downloads by itself. It only has a level of security which at higher settings can ask you if you want to d/l something, or flat out ignore it.
When you password such things, typically you are using another program, as far as I know.
In those other programs, password retrieval then becomes based upon which program he's using.
In that case, there are several options. It could be saved in the registry under that program (doubtful, but happens occasionally) which protects the computer at a registry level...
Or it could be just one that has it recorded in a save file in located under some name in the actual program folder.
It could also be kept in a hidden folder via the Temporary Internet Files cache, to keep it there, but also keep it from being deleted.
Finally, it could also be kept in the program itself, in which case it's nigh impossible to retrieve (unless it has a retrieve program) unless one can dissect and fish through many lines of code.
My guess is that he has some extra firewall program out there protecting his IE, and that's what he put his password on.
I could be wrong, but I've never seen IE have password protection for d/l or popups integrated in it on it's own W/O an extra program there to aid it.