Send an expiring URL to a "choose a new password" form. Resetting the person's password allows for a denial of service where an attacker can constantly reset a person's password out from under them. When you email a URL to change the password, the old password is left alone until the link is clicked and a new password entered.