Anything that restricts the set of possible passwords makes it more vulnerable to a brute force attack. The only reason to forbid some passwords is if the restriction to the password space is compensated by the high propensity of users to pick passwords that can be easily guessed.
Let's say you would like passwords with at least 38 bits of entropy (that's already very high for a password that can only be attacked online under normal circumstances). That requires a password space of at least 274877906944.
Forbidding passwords that are too short is reasonable. Assuming the character set is restricted to the 94 ASCII non-space printable characters, 6 random characters are the minimum (689869781056). Forbidding shorter (≤5 characters) passwords barely makes a difference: there are only 7417954634 of them — the passwords of length 5 or length only make up 1.1% (a little over 1/94) of the passwords of length up to 6. And because users rarely pick completely random sequences of characters, it makes sense to have an even higher minimum length. A minimum length barely makes a dent in the password space, because it grows exponentially.
Forbidding a character, conversely, makes more and more of a difference as passwords get longer. Let's say you pick a password with 8 random letters and a random digit at the end (and don't rely on the punctuation character for entropy). That gives 2088270645760 possibilities — over 241, meeting the 38-bit requirement. If you forbid as little as one letter, the password space shrinks to 1525878906250 — that's 27% of the password space wasted right there. With 6 forbidden letters, the password space shrinks to 256000000000 which is less than 238.
Random letters are hard to memorize, so there are better methods to generate longer but more usable good passwords.
corrEct horSE battEry StapLE? Nope, I can't use that. Let's take the popular Diceware list of 7776 English words and memorable letter and digit sequences. 3 random items on the list satisfy the 38 bits requirement (77763 = 470184984576). But 3 random items that don't contain any letters of my username? Only 2130 items fit the bill, leading to 9663597000 possible passwords, only 33 bits. Still decent, but less than our target. And the Diceware list has an annoyingly high number of special characters if you're going to type that password on a mobile device. I have a list of 4172 short, common English words, and can pick 3 random words to get 37 bits of entropy, which with an added digit gives the required 38 bits (726160964480 possible passwords). If I exclude letters in my username, that drops to 787 words, for only 29 bits with no digit or 33 bits with a digit.
Forbidding common characters for users who deliberately pick good passwords is bad, and I've bored you with the math to show it. What about the users that password restrictions really target — the 99% who don't pick randomly?
Girlfriend's name? No. Mother's maiden name? No. Hometown? No. Damn, this is difficult, the restriction must be working!
zxcvbn1 works for me, how lucky.