The email uses sprintf on its language string with the following sprintf replacements.
1 = username
2 = site url
3 = new password
If you just specify %s they'll replace in the order as parsed. So for example "Username: %s, Site: %s, Password: %s" would all be correct. If you want to move them around you need to use %#$s usage. So for example if you want the password you'd use %3$s. See sprintf documentation for further usage details.
php.net/manual/en/function.sprintf.php
We'll be replacing all these old strings in a future release when we refactor that code to make them proper substitutions.