badChar = invalidChars.charAt(i);
This takes the i'th character of invalidChars, and assigns it (as a string with length 1) to badChar. For instance, since invalidChars is " /:,;" (it's assigned that value at the top of the script), then when i=0, badChar will be " ", when i=1, badChar will be "/", when i=2, badChar will be ":", etc. The loop goes through every character in invalidChars this way. The purpose of this is to make sure that none of the characters in invalidChars is in the email address. That's what the next line does:
if(email.indexOf(badChar, 0)>-1)
This line can be read as "if (email contains badChar)." indexOf is a way of checking if one string contains another string. Take this example:
A.indexOf(B)
if A contains B, then this will return the position at which B starts within A. (0 is the first position, 1 is the second, etc.) For instance, ("hello").indexOf("llo") returns 2. ("hello").indexOf("he") returns 0. If B is not found in A, then this returns -1.
The second argument of indexOf is optional, and specifies that you should start searching at the given location (ignoring B if it starts before that location). When this is zero, it has no effect, so I don't know why the writer bothered to specify it.
So, that line checks if the badChar is in the email. If it is, then email.indexOf(badChar, 0) will be zero or above, which is greater than -1, so the function will return false.
By looping through every character in invalidChars, it makes sure that the email doens't contain any invalid characters. (A safer and more thorough way to do this would be for it to contain a list of characters that *are* valid, and if the email contains anything *else*, returning false. You might want to try to figure out how to do that for practice.)
email.indexOf("@", 1);
As I explained above, this line will return the first position of the "@" character within the string email. If the "@" character is not found, this will return -1. Note that since the second argument is 1, and not 0, this will return -1 even if the "@" character is the very first character in email. It must be the second character or later within email.
Later on, the script uses the line
periodPos = email.indexOf(".", atPos);
using atPos as the second argument ensures that the period is only found if it's after the "@". If the only period is *before* the "@", periodPos will be -1.