CB

"If you forgot both your username and your password, please recover the username first, then the password. To recover your username, please enter your E-mail Address, leaving Username field empty, then click the Send Username button, and your username will be sent to your email address. From there you can use this same form to recover your password."

The message directly states to first request username then request password. So appears to be working as intended. There's no case in source to handle username AND password, but should there be? Would seam better to have such a case then have the user use the recover feature twice? and if this is the case it should be a Radio button and not a checkbox, seams pointless to be able to select both if you can't receive both.

Yes, this works as intended.

You should never put username and password together in the same email on mid- to high-security sites.
Closing.