My only fear of doing this is that someone could call in and say "oh sorry, I just typed in a bunch of random numbers and letters" and the rep will go "haha, don't we all!" and let them reset the password.