Say Joe User has an account at your site, and Arnie Asshole knows Joe's email address, and he knows that Joe uses a web accelerator. So he goes to your site and

Say Joe User has an account at your site, and Arnie Asshole knows Joe's email address, and he knows that Joe uses a web accelerator. So he goes to your site and puts in Joe's email address. Joe goes to look at the resulting email he gets in his webmail, and bam, his password has been reset without his knowledge, because his web accelerator followed the link in the email. The workflow should be like this: 1) as in your example 2) as in your example 3) User clicks on a link in that email and visits a GET page. The GET page has a form with a single button ("Really Reset My Password" or something), or maybe it has a form right there for him to enter his new password. 4) He clicks the submit button, and the form submits right back to that same url, with the reset code embedded in the url, but this time it's a POST. 5) Your site's code detects it's a POST this time, and changes the password. I was never suggesting you bypass the email verification step. Just add an extra screen between clicking the link in the email, and the password actually being reset.