I thought they said, they do not save any passwords on their servers?
Not sure about the details (haven't checked mnemonic.js myself), but it seems the mnemonic is just an encoding of your password.
So, bc.i doesn't save your password, but is able to decode the "mnemonic" when you enter it in the "forget password page" and get back your password.
How exactly is it implemented? What strength does the mnemonic provide (bits etc)? I assume you are using the electrum seed encoding (interactive en/decoder at brainwallet)?
It is almost the same encoding as electrum but with the addition of a checkum and version byte.
https://github.com/blockchain/My-Wallet/blob/master/mnemonic.js the entropy provided will be the same as the password itself, the mnemonic will grow or shrink depending on the length of the password.
My concern is that there is an addition of another way to decrypt my wallet (or worse, my password itself).
It recovers the password itself.