I don't think it has any holes, but it could be inconvenient if they clear their cookies or want to use your site from a different computer. Instead of remembering one of their standard passwords, they have to dig through their email to find the link you sent them just to use your site.