The problem I had was that users were not able to get their passwords reset via email from Community Builder. When they tried, they got an Access Denied message.
It turned out the users with this problem were Admin users, and apparently AdminTools blocks password reset if Admin users cannot be created on the front-end (a reasonable default for that parameter).
Anyway, I have no interest in debating what the correct behavior should be. I only wanted to highlight it to you in case you weren't aware of the behavior.
Thanks for all of your help in the past.