With regards to #2 - the assumption with his design appears to be that the input field is long enough to fit the longest username and the password. Given that both the username and the password lengths are typically capped at relatively short values, the assumption is reasonable. But even if there is an overflow, I don't really see it being a problem - the password is no different from a regular input except that all chars are dots. If whatever is typed does not fit, the regular scrolling paradigm will still apply here.

With regards to #3 and #4 - a standard password input control can be used to capture and display the password. Make it borderless and reposition it dynamically based on the length of the username. Not that it'd be a very elegant implementation, but it is doable nonetheless.