Update: Looks like the password is still the old password for the
test-user. So the new password that is announced via email never makes
it to the database.

I'm running an almost unmodified classic template but with some of the
class-permissions (issue, user, ...) removed from the anonymous user.
I'm using an ancient config.ini that was just updated with the recent
settings but everything was left at the defaults.