example+boinc@example.com
results in an account created(or looked up) with the email 'example boinc@example.com'

I wish there was a FAQ that contained exactly what is taken into consideration when matching accounts. From what I can gather it's name, email, and password.

Also.. Isn't there a way that this could be configured so that this place doesn't email your password back to you and instead have it simply reset your password to something else? Is there any chance that eventually there could be some kind of API to manage accounts, where no one would have to store the password directly.. maybe just a salted hash of it?

BTW, what am I supposed to do with the spare accounts that were created with this bug? Just scrub the information from them and leave them alone? I don't really have any use for them.