Quote Originally Posted by lhungil View Post
and I believe it is also configured out of box to force the user to change the password if they use the reset_token (I'd have to take a deeper look at the code, but this is what I remember the last time i used the password_forgotten form).
correct. If they use the token, then they must subsequently choose an actual new password.

Quote Originally Posted by lhungil View Post
I consider the enforced password change a nice security feature. Far too many people think unencrypted email is a safe method for transmitting passwords days!
Agreed.
And the token expires after a couple days, so cannot be misused months down the road by someone taking over a former employee's email, etc.