Yes, that is a much better way to do it. Also the resetting user should be asked to provide their email address rather than the public forum username which is

Yes, that is a much better way to do it. Also the resetting user should be asked to provide their email address rather than the public forum username which is easily scrapped.