Since secure password hashing is a second line of defence, its effectiveness cannot be tested until the first line of defence is breached, i.e. the server is hacked into, or they do something stupid like sending your password by email.
As others have explained, if the site can send you back your own password, then, by definition, they stored it, and not just a one-way verification token (usually designated by "password hash"). This is a definite clue about very insecure storage. However, if they do not send your password back, it still does not mean that they store it securely. They could still store it reversibly (e.g. encrypted instead of hashed), or they could even hash it with a weak password hashing function (e.g. without salt, or with a hash function which is way too fast, or both -- see this answer for details).
Other clues of bad password storage include:
After-the-fact detection of "bad passwords": if they send you an email stating that your password should be changed because it does not comply to some internal rules, then they have access to the password asynchronously (i.e. not just when you enter it for authentication), and that's bad.
Rejection of similar passwords: if you change your password with a new password which is very similar (but not identical) to a previous password that you used, and the site rejects it on that basis, then the site can know which passwords are similar to each other, which again implies reversible storage.
Very fast response time. This one is hard to measure and you cannot certainly do it by hand; it has to be scripted. When you send an authentication request, you can measure the time it took for the server to answer. During that delay, with normal password hashing, the server must have computed the hash function. For better accuracy send many authentication requests; if the server can handle 100 requests per second then you know that whatever hashing they used requires no more than 1/100th of their CPU power. Warning: if you do that, you may be detected as an attacker trying to do a dictionary attack (conversely, if you are not detected, then this means that the site is not protected against online dictionary attacks, and that's bad, too).
Personally, I'd say that enforcing a password change every 90 days is already a sign of bad password management in general. In any case, you shall not reuse passwords. When you do not reuse passwords, the lack of security in password storage on one site is much less critical.