How can I find out where Emacs is checking for passwords?

You can see a list of current auth-sources by running the following elisp function

> auth-sources
(password-store "~/.authinfo.gpg")