The issue is that the backticks in the SQL are treated as command substitutions by the shell. The shell would try to run backticked string as a command to replace that bit with the output of that particular command.
The shell does this because you
echo the string with double quotes.
To solve this particular issue, escape each backtick as
Ideally, you would pass the SQL as a single quoted string, but that would mean that the variables wouldn't be expanded.
You can also do it this way, which would be safer:
printf 'INSERT INTO `mailbox` (`username`, `password`, `name`, `maildir`, `quota`, `local_part`, `domain`, `created`, `modified`, `active`) VALUES ("%s", "%s", "", "%s", 0, "xxx", "xxx", "date --rfc-3339=date", "date --rfc-3339=date", 1);\n' "$username" "$pass" "$xxxx"
... assuming the particular database you are using can handle double quoted field data.