Request New Password Security

This was planned as an add on module. It's untested but it's code to begin with. Comment out the two lines that registers user/password in user_menu. You need a pwdreset table for this

CREATE TABLE `pwdreset` (
`name` VARCHAR( 255 ) NOT NULL ,
`time` INT NOT NULL ,
`random` VARCHAR( 40 ) NOT NULL 
);

function pwdreset_menu($may_cache) {
  $items = array();
  if ($may_cache) {
    $items[] = array('path' => 'user/password', 'title' => t('request password change'),
      'callback' => 'pwdreset_page', 'access' => $user->uid == 0, 'type' => MENU_LOCAL_TASK);
    $items[] = array('path' => 'user/pwdchange', 'title' => t('request new password'),
      'callback' => 'pwdreset_change', 'access' => $user->uid == 0, 'type' => MENU_CALLBACK);
  }

  return $items;
}

function pwdreset_page() {
  if ($edit['name'] && !($account = user_load(array('name' => $edit['name'], 'status' => 1)))) {
    form_set_error('name', t('Sorry. The username %name is not recognized.', array('%name' => '<em>'. $edit['name'] .'</em>')));
  }
  else if ($edit['mail'] && !($account = user_load(array('mail' => $edit['mail'], 'status' => 1)))) {
    form_set_error('mail', t('Sorry. The e-mail address %email is not recognized.', array('%email' => '<em>'. $edit['mail'] .'</em>')));
  }
  $message = t('You must provide either a username or e-mail address.');
  if ($account) {
    db_query('DELETE FROM pwdreset WHERE time+%d < %d', variable_get('pwdreset_time', 216000), time());
    if (db_num_rows(db_query("SELECT 1 FROM pwdreset WHERE name='%s'", $account->name))) {
      unset($account);
      $message = t('You have a pending password change');
    }
  }
  if ($account) {
    mt_srand((double)microtime() * 1000000);
    $random = user_password(40);
    db_query("INSERT INTO pwdreset (name, time, random) VALUES ('%s', %d, '%s')", $account->name, time(), $random);
    $from = variable_get('site_mail', ini_get('sendmail_from'));
    $subject = t('Password change request for %username at %site', $account->name, variable_get('site_name', 'drupal'));
    $body = t('%username,\n\nYou have requested new password for %site. You may get your new password at %dynamic_change. ', array('%username' => $account->name, '%site' => variable_get('site_name', 'drupal'), '%dynamic_change' => url('user/pwdchange/'. $random, NULL, NULL, TRUE)));
    $headers = "From: $from\nReply-to: $from\nX-Mailer: Drupal\nReturn-path: $from\nErrors-to: $from";
    $mail_success = user_mail($account->mail, $subject, $body, $headers);
  }
  else {
    if ($edit) {
      drupal_set_message($message, 'error');
    }
    // Display form:
    $output = '<p>'. t('Enter your username <strong><em>or</em></strong> your e-mail address.') .'</p>';
    $output .= form_textfield(t('Username'), 'name', $edit['name'], 30, 64);
    $output .= form_textfield(t('E-mail address'), 'mail', $edit['mail'], 30, 64);
    $output .= form_submit(t('E-mail password change request'));
    print theme('page', form($output));
  }
}

function pwdreset_change($random) {
  if ($result = db_query("SELECT name FROM pwdreset WHERE random='%s'", $random)) {
    $name = db_result($result);
    db_query("DELETE FROM pwdreset WHERE random='%s'", $random);
    $_POST['edit'] = array('name' => $name);
    user_pass();
  }
  else {
    drupal_not_found();
  }
}