URL filter maximum link length can break password reset

When a user requests a new password, they receive the one-time link in an email, but when clicked they were getting the message:

"You have tried to use a one-time login link which has either been used or is no longer valid. Please request a new one using the form below."

The Bbcode URL filter was set at the default of 72 maximum link text length. The one-time link sent in the email exceeded 72 characters and ended with "...". I changed the Bbcode maximum link length to 110 characters and the password reset worked!

I assume it's a bug that this code is interfering with system-generated links. I thought it would only affect a link in a content node. We also use the logintoboggan module.