Never written any really secure php stuff but I do recall on other sites when I forgot my password they wouldnt email me the password but instead gave me a onetime URL ( presumably the parameters passed identify me as the user ) where I can go to and it will allow me to enter a new password.