Sounds like a credit union I used to use that restricts the charset, is silently case-insensitive, and emails you <i>your</i> password if you go through the lost password dialog (it had been upcased).  I sent them a letter chewing them out for this joke of security (about a year ago), and they still haven't changed anything.