Their password reset form didn’t have the restriction, so you could reset your password to 21 chars, and then never log in again