The ampersand (& symbol) might make sense due to the following fact: a form is usually submitted as urlencoded:

     name=drostie&password=wining%20%26%20dining%20the%20suckas!&language=en-US

and they might be worried about some browsers not correctly URLencoding such a form field -- or else they're perhaps worried that their own URLecoding decoder will break.

The exclamation mark is weirder -- I can't think of a deep need to escape that symbol. The + symbol, maybe, since sometimes + in a URL is supposed to be used as a replacement for %20 as an encoding for a space, but not the ! symbol.