I think this is a bug.
Both my admin password and my root password ends with a number. My friends acounts password does not. The fact is that you can add letters and numbers after the password (which ends with a number).
example: i enter the terminal and type 'su'
then i type [myrootpasswd]uglyboyinwheelchair and the computor accepts it!! Just because my root password ends with a number. same thing on the login screen with my admin passwd. Altough this does not work with my friends user passwd (does not end with a number).
I'm not completely sure what you're claiming as a bug, but does the fact that only the first eight characters matter in a password explain anything? Ie, "mypassword" and "mypasswordisnowreallylong" are in fact the same since the first eight characters are the same, anything past that is not used.