I can't help but feel that this is of equivalent or better security for users on sites that allow password-reset-by-email.