I encountered a problem with one of our vendor's login pages. I found that sending them a link that added a giant "YOU HAVE A PROBLEM HERE" graphic to the page and popped up an alert containing your password when you hit submit got the point across better than trying to explain it.

I probably wouldn't have done that if I didn't already have a relationship with the vendor, though. I don't want to be accused of extortion or cyberterrorism.