The user receives the correct email without a directing URL, email address, or password–just the 2 characters —%s—-instead.
Another side of what may be the same problem is that new users (from cookie free browsers) who visit the site are not offered a “sign up” option—just “log in”.