If you routinely forget your password it doesn't really matter if you always get a new/different password, now does it?

edit: not that this is the best way to go (see other comments) but it's still miles better than what they have now, with minimal intrusion for their users.