The password recovery scheme is so poorly designed, that's borderline scary: You can't use the recovery code sent by email after registration without validating your email first (but since you have the code, your email is obviously valid)... which requires you to login (but if you don't have your password, well, you can't log in)... Great!... one lost account for me.
+1, the recovery code shouldn't go out in plain text email. Also, I picked a weak password just to quickly make an account and I can't seem to change it, hmmm.
