It's also a particularly bad implementation that uses a single round of HMAC-MD5, which is a kind of bizarre primitive to use for hashing a password in the first place.
For that matter, this solution is probably even more complicated than it needs to be. Just tack on the domain name wholesale to the end of the password, and you'll foil any automated phishing password script well enough.
Of course you are, because this password does work on other sites. All other sites.
With a single high end CUDA capable graphics device you can blow through 500 million MD5 operations in one second. How many words are in an English dictionary? Less than that.
That's how weak this is. If you steal the password database from bigforum.com, you can attack all the passwords in parallel. If you crack a password, you can then log into their facebook, gmail, paypal, whatever. This scheme pretty much guarantees you can do that.
hash(password + domainName);
salts.put(domainName, randomString());
hash(password + salts.get(domainName));