To restrict the characters used in the user name creation you can add this to your user.config

<add key="UserNameValidationExpression" value="" />

"You can specify a regular expression to constrain what characters may be used for the
         User ID. This is also used for the Display Name when a user registers. If you leave it
         blank, no validation will occur. For instance, to limit it to alpha numeric characters and
         underscore, you could use an expression like:
               ^[a-zA-Z0-9_]{5,20}$
         This requires a user id with minumum length 5, and max length 20, that can only use
         alphanumeric characters and underscore. Make sure you do not enter an invalid regular
         expression or it can cause an error. Also make sure the UserNameValidationWarning setting has
         a message that can help the user correct the problem if they enter something invalid"

And add this for show a message to the users

<add key="UserNameValidationWarning" value="User ID must use only alpha numeric characters and underscores" />

if your using forms authentication change the timeout

<authentication mode="Forms">
      <forms name=".mojochangeme" protection="All" timeout="50000000" path="/" cookieless="UseCookies"/>
    </authentication>

For #1, I don't think there's a direct way to do it, but as a workaround you can use the same idea that German outlined for username validation, but for the password. Navigate to Administration, Site Settings, Security. Either set "Minimum Password Non-Alphanumeric Characters Required" or add a "Password Strength Regular Expression" and "Password Strength Error Message" that forces the use of special characters in the password. That will ensure that the username and password don't match.

#2 will be an enhancement request, as far as I know. I'm not sure how useful that option will be, since there is no password expiration ability. Typically a "password must be different than the last X passwords" option is used in conjunction with a timed password expiration option. In mojoPortal, a password reset will only happen if someone forgets their password and requests a new one, or an administrator manually changes their password so they can't get in without a reset.

Hope that helps,

Jamie