.{5,} that's why it allows special characters (dot = everything (except line feeds and such in fact)). Change it to [a-z0-9]{5,} or whatever you want.
Note: (?=.*\d{1,})(?=.*[a-zA-Z]{4,}) only check the 2th and 3rd requirement, but don't say anything about the wanted nature of the characters.
Edit:
Other problem: your specification says "at least 4 letters" but your regex says "4 consecutive letters". Also, use lazy quantifiers.
/^(?=.*?\d)(?=(?:.*?[a-z]){4})[a-z0-9]{5,}$/i
(?=.*?\d) => you don't need to check for more than 1 number, once you found it, stop.
(?=(?:.*?[a-z]){4}) => changed to find 4 letters, but not consecutive. Also, added an insensitive case modifier i at the end (in JS, in Java you're not declaring it the same way).
ro1otseems not matches^(?=.*\d{1,})(?=.*[a-zA-Z]{4,}).{5,}$