To answer you question, I do not know of any way to get or reveal the password out of WinCC Flex.
However, you can still download the WinCC Flex project without concern for the passwords. When the download window appears, make sure the "Overwrite password list" is not selected. Now when you download the project, you will not overwrite the passwords in the HMI.
As for finding out what the passwords are, isn't there someone you can ask who knows what they are? There must be someone who knows them. If there is no one who knows them, then what does it matter, you can change them.