When a user request a password reset link he still gets the ‘confirm Use of Weak Password’ checkbox and it accepts weaker passwords than the minimum I had set.

On the settings page, under Documentation there is a mysterious link ‘Understood what a regex’ that leads to a non-existing page.