Drupal 7, login, "form_build_id" not used?
As drupal_prepare_form() notes:


  The form_build_id is used as key to cache a particular build of the
  form. For multi-step forms, this allows the user to go back to an
  earlier build, make changes, and re-submit.


More than anything else, form_build_id is for maintaining the form state through page requests. As you can see in some of the core processing functions (e.g. drupal_build_form(), drupal_rebuild_form(), &amp; drupal_process_form()), form_build_id isn't required for form processing.

In some instances (e.g. multi-step forms) breaking the form_build_id would break the behavior of the form since there is previous data to retrieve, but for the login form there's no state needed to be preserved.