There's no benefit to recovering a current password. If you can determine that the requesting user should be able to receive the current password, you can skip

There's no benefit to recovering a current password. If you can determine that the requesting user should be able to receive the current password, you can skip that step and just ask them to set a new one.