skx

The way that I've always handled this is to only show the "Forgot Password" link after a login attempt fails.

Maybe that's unfair; expecting a user to attempt to login even if they're not sure of their details, but it always seemed reasonable enough to me.