Simon,
Woah! Very sorry for the delay in getting back to this. It seems to have skipped out of my to-do list somewhere along the way.
Are you still working on this? I'm glad you found that the events were being called. We couldn't recreate what you were seeing before, so that helps get us on the same page. As for your questions:
The Password, may be handed off to CB but you may have to look for it differently. If you're using the "Facebook User Only" setting, it's definitely not handed because there is no Joomla user password that goes with it. If you're using "Full Joomla User" it may not be coming in the $cbUser variable (not sure), but if it isn't, you can fetch the entered password by checking JRequest::getString('password'). That will only work during registration though.
With that said, and since you may not be able to get the password at all, more explanation of how you're syncing to your other DB may help. If possible, the best to do would be to map a row in your other database to the user ID in Joomla. Then, when a login happens in Joomla, you simply tell the other DB that the user is logged in.. bypassing authentication altogether which is already happening in Joomla. Not sure if that's possible, or makes sense, but hopefully helps.
Again, sorry for the delay, and should you still be wrestling with this and need help, please let us know.
Thanks,
Alex