Why didn't you just require password resets to be done by the user?