>>FWIW I read that doing things like adding options to DropDownLists in client code can trigger the "Invalid Callback" exception.....
>
>In the page it happened, it was in the password recovery page and this has no DropDownList control.

I did say 'things like'. Any client side code that changes available options (or returns a value that was not an option when the code was generated on the server) can cause the exception.

But this only applies to event validation - you didn't clarify whether it was this excepion or 'Invalid ViewState'
>
>I will however add a static machine key and see if this will resolve the issue.