I just tested (Because I have no idea what my user password was on the N900... *Shrug*). sudo gainroot, then passwd user. And yes, you're right, it IS the same password you use to log in through SSH. Made me rather happy to find that out.

However, I also noticed it wasn't letting me run "passwd user" as user. It basically told me I wasn't allowed to change that password. (Worked fine as root though.)

As for mounting from USB... Not sure. I do know that you can use the flasher to merely load a kernel into memory instead of reflashing. And you can use the rescue kernel on the MeeGo project site (don't ask me how, I don't know, I never had to), to boot into some form of shell from which to recover the device...

Multiboot and BackupMenu both have the ability to drop you into a shell early in the load process. BackupMenu is pretty versatile/powerful, as far as that goes. You can definitely mount rootfs from within it, get SSH access from the 'outside', and scp your requisite files, or unpack a backup'd one. Problem is, if you don't have them installed before you bootloop/bootstuck, you can't really get it back on the device without some extra hacking. I suppose if Flasher was open source, or something similar existed, one could create a kernel image that drops you into the backupmenu shell. Then just either flash, or do the non-flashing load-into-RAM-and-boot-with-it method... But I don't know of any such images.

The user friendly best bet is just reflash and be done with it, I'd say. The harder method is find that rescue kernel I mentioned, and boot into that using Flasher, and hope you can get enough filesystem access and a passwd file that's close enough to what you had to fix your system. The only thing is, I don't think /etc/passwd counts as part of the kernel, so a flashed/loaded kernel will still presumably try to read that passwd file - unless, again, the drop-into-shell comes first.

...I suppose if uboot got more popular, a BackupMenu port, or a similar script, could be ran from within uboot, which CAN be flashed/loaded in as part of a kernel image, and will load/run before the actual kernel stuff and beyond happens.