3 to 30 letters, digits, underscores, dots or hyphens. Capitals do not make it a different username.
8 to 128 characters.
There is no email, so an admin resets a forgotten password.