The captcha for resetting displays mixed case letters, but doesn't appear to be case-sensitive (#153).
Resetting a password also supports SMS response (from 729725, natch) with a six-digit code (like the email) that expires 5 minutes from sending, and a phone call (don't know from what number, the option expired after requesting an email and a text).
Some observations not included here: