After recognising a key press you must wait until no keys are pressed
This assumes that the code is waiting for a key to be pressed. It is not.
OP: On any given pass through loop(), you have to determine if a key is pressed. If not, do nothing. If it is, add it to the array, in the proper place.
Of course, this means that you need to keep track of how many keys have been pressed.
There are some other things you should do. Do NOT assume that the password is exactly 4 characters. Of course, this means that you need some way to indicate that the password has been fully entered. You also need a backspace mechanism, in case the user makes a mistake, and wants to undo the last keypress. Fortunately, you DO have to other keys that could mean enter and backspace.