There are more bugs.
Wrong password page will reveal facebook user associated with an email..
Entering an old password into Facebook will tell you as such [1]. I can't really think of a practical attack for this towards facebook, but I'm really weary of any system that reveals information about passwords, even though I somewhat feel I'm being overly paranoid. Password recycling just seems to be too prevalent to allow me to ignore this, even though it seems impractical to me. I guess I just don't like that it reveals password information.
Enough failed logins automatically sends a temporary login pin to the email on file. Again, I feel that in a practical sense this isn't a big issue since if you can get access to the email that has the login pin you also likely have access to the victim's machine that is already logged in, but it still feels like a weird practice to automatically generate temporary credentials without being asked.
On the other hand, major utility boost for users. "I KNOW this is my password!" Actually, it was your password before you changed it. "Oh right."
I know I do this quite frequently. Enter password. (Wrong.) Guess I have to change it. Reset. (New password must be different than existing password.) My "new" password is the one I changed it to last time, before forgetting.
try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time.
There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.
The password reset page's behavior depends on Facebook matching your browser/ip/other signals.