When not logged in, going to community.roll20.net has logon options. It's not clear that it doesn't use your Roll20 account here (or if you're supposed to be able to, it doesn't work) -- the right half of the sign in popup does have a "sign in with roll20" link, but it's easy to overlook. Doing password recovery in there (to a valid account email address) gives error message "Could not instantiate mail function".
Using an unknown email address both here on forgot password and on forgot password at <a href="http://app.roll20.net/sessions/new" rel="nofollow">http://app.roll20.net/sessions/new</a> give different error messages whether you give a known email address or not. It's standard practice always to tell the user something like "if this is a valid account, a password reset message has been sent" to prevent snooping of register usernames/addresses depending on the different error messages.
There do not appear to be any serial failed login delays, lockouts, timers or captchas -- not a big deal though.
Tested in both FFX 12 and IE 8 on WinXP.
