I suggest create a link with random number and user id and send it via user's email. All user need to do is just type in email and link with those details will be sent via that password (which must match database's email).
After clicking a link, then user will reset the password and either he will be taken to a form to change a password or the one-time-login password will be sent to a user (randomly generated) After login with one time login, force them to change that password
Hope it helps
Reputation Points: 462
Solved Threads: 392
Senior Poster
Offline 3,681 posts
since Jun 2007