"A very subtle usability problem we have been experiencing is about the Forgot Password form. We have tested this in our production version (1.8.3) as well as on our testing version (1.9.4) and it seems to be unmodified up to now.
The forgot password form offers two inputs: user and password, of which one, and only one, must be filled. Now, if both of the fields are filled, the only error shown is "Enter either username or email address". This happens to be confusing a LOT of our users, since offering two inputs motivates them to type both fields. "
The form elements are simply being used misleadingly. Giving both the form elements their own submit buttons and optionally also separating them visually with the word "OR" will make it clear.