Your description is quite unclear, but it sounds like you are saying the following:
- You went to your hosting provider's control panel page, which is over plain HTTP (RED FLAG)
- You found there a log (list of records) of past connections, including the IP address you were connecting from (totally normal)
- This log also contained the password you used to log in? (RED FLAG if true)
- Regardless of whether it was in the log or somewhere else, your hosting provider returned your password, in plain text, somewhere (RED FLAG)
Each place I've marked RED FLAG indicates that your hosting provider is dangerously insecure, and should not be used for anything. Any company with even quarter-decent security these days will be using HTTPS for all sensitive traffic (including authentication - logging in - and everything you do thereafter such as accessing a control panel). They will also NOT be storing passwords in plain text anywhere (including in logs!), much less revealing plain-text passwords over the internet. A company that can't manage these things is so incompetent as to be indistinguishable from malicious. None of these best practices, or how to adhere to them, are new, complicated, or obscure.
What is the IP log ?
Most web servers store a log of users, especially users who try to log in. The entries in this log almost always contain the IP address of the user's device. (Something termed an "IP log" might contain little else, except a timestamp.) This is normal and useful data, as it helps with things like diagnosing user problems or analyzing traffic for malicious activity. Some extremely privacy-focused sites might avoid logging IPs (or delete entries from the log after a very short time) so that nobody - not even they themselves - can tell who used the site after the fact... but that's extremely rare.
Critically, however, logs of any sort must never contain any highly-sensitive data. Log storage is usually not especially secure. It generally shouldn't be public - only authorized users should have access - but it's also usually not very tightly restricted, or encrypted, or similarly secured. Additionally, some highly-sensitive data - such as passwords and other authentication secrets - should literally never be stored in plain text (or, ideally, under reversible encryption) anywhere at all. Rarely it may be necessary to store password-equivalent hashes, or passwords under reversible encryption, within secure storage on a server; there's no need (or excuse) for putting them in logs.
Can I create an additional email account and use this password again?
NEVER re-use passwords. This is basic, fundamental security practice. If you use the same password with multiple sites, then any of those sites can impersonate you to any of the other sites. In essence, you are claiming that you consider all of those sites to be the same, trust-wise; anything that any of them are able to see (of yours) or do (on your behalf), they all are. To make matters worse, you are increasing the "blast radius" of a security compromise at any of those sites; an attacker who gets your password on any of them (via any means: improper password storage / modifying the server to copy passwords as they're entered / brute-force guessing / watching over your shoulder as you type / etc.) now can log in as you on all of them.
Use a password manager instead. There are tons of them. Every major web browser has one built in, as do both Windows and MacOS (and most desktop Linux environments). Furthermore, there are many purpose-built ones, commercial, free, open-source, etc. They have all sorts of properties and features - some support syncing between devices (with varying security along the way), some support storage on a different computer so you don't lose them if your device dies, some support generating new passwords for you, some support automatically filling credentials when you open a webpage, etc. - but even a very simple, relatively weak option - like a "passwords.txt" file on your computer - is arguably better than re-using passwords across sites (it definitely is if you don't share your computer's login account with anybody, and there's a password on the computer's account).
Am I doomed?
Well, unless medicine gets a whole lot better in the next few decades, everybody alive today is. Less existentially, though, you absolutely should change the password on every site that is currently using the same password as you used on the hosting provider (and don't use that hosting provider for anything!). After that, you should change all your other passwords (assuming you have more than one right now) that were ever used in multiple places. (Obviously, each new or changed password should be unique and unpredictable!)
You might also want to check your account(s), and password(s), to see if they've been compromised. There's a really cool site, https://haveibeenpwned.com/, which tracks known site compromises and lets you see if your username/email/phone number were used on any site with a breached account list. You can also use https://haveibeenpwned.com/Passwords to test whether your password has ever been used (by you or anybody else) on a compromised site where passwords were recovered. It uses some clever client-side cryptography to avoid ever actually sending your password to the server, and the owner of the site (Troy Hunt) is well-known and respected... but frankly, if you're leery of entering a password you used anywhere into a new site, good for you! That's generally not something you should do! One way to handle it is change the passwords on all your accounts first, and then test it on https://haveibeenpwned.com/Passwords; that way, you can see whether an attacker would have had it, without risking giving Troy any of your current passwords.