My concern here is that if there is a restriction on what passwords can contain, how are they being stored?

It seems concerning that between entering and hash/(b/s)crypt-ing passwords there would be any step which required these limitations. A regex or similar validator on strength not equipped or written to handle other characters? Either way... really?