Think about action user.forget_password

[r-peschke]

This action has some security problems
Some ideas:

• Possibility to disable the action
• Use email and username, reducing the amount to one email
• make the field email unique, may be optionally for the instance
• Use some stuff for additional user identification: Store some personal questions, use sms with transaction code for confirmation or other user identification