It looks like the 'forgot password?' prompt does not consider uppercase characters in the domain of an e-mail address to be valid. It says 'Please enter a valid email address.'
I registered with My.Name@Sophos.com, but the password reset form would only accept My.Name@sophos.com. This might be valid but it was frustrating to double guess what was invalid about it.