The registration has two junk checkboxes (#175), one for promotions and one for tracking
ToC acceptance on registration is implicit
Registration requires zip or city+state to select preferred store
Password reset request stub does not appear to distinguish existing accounts from non-existent ones
Password reset submit stub links to signin
Password change is tied to email update, where both email forms are pre-filled and listed as required inputs
Password reset while logged in works identically to reset while signed out, you even end a stub linking to the "sign in" page even though you remain signed in
Not only do they not invalidate reset tokens after use (!), they appear to not send multiple reset emails! I requested a second one after requesting the first one (before using it), and only got the first one.
Changing a password through reset triggers a notification email. I don't think changing it via settings does, though. (Or I might have this backwards - but the bottom line is that I'm pretty sure only one or the other triggers the notification, not both.)
Stray observations: