You could use a suitable lisp-function which returns the suitable string.
E.g. if you already had function `my-secret-password' which picks the password for a user, you could write
** MySQL Analysis
:header-args: :engine: mysql
:header-args: :dbhost: localhost
:header-args: :database: MY_DB
:header-args: :dbuser: DB_GUY
:header-args: :dbpassword: (my-secret-password "DB_GUY@MY_DB" )
:header-args: :cmdline: --protocol=tcp
:header-args: :exports: both
Also note the syntax of the properties for the recent Org version.
It remains to write the suitable function (to replace the `my-secret-password' from above.)
I think this function could build on `auth-source-search' (and needs some energy to get into existence.)
Invested some energy (20161117):
After a little research I found a concrete example how to pull out a password from the return of `auth-source-search'.
With my personal settings I get my password for firstname.lastname@example.org with the lisp line
(funcall (plist-get (car (auth-source-search :user "email@example.com")) :secret ))
You need to find such line for your 'dbpassword' and insert it at the right place at the properties. Possibly it is
:header-args: :dbpassword: (funcall (plist-get (car (auth-source-search :user "Peter@my-super-db")) :secret ))