Lets say you want to give the user a 1 step process to get back into their account. You can 1) Email the password or 2) Email a unique link which lets them res

Lets say you want to give the user a 1 step process to get back into their account. You can 1) Email the password or 2) Email a unique link which lets them reset the password for their account. If you do #1 the person likely used that password on other accounts. Now you've not only compromised access to your service, but any other that has the same password. IF you do #2 the user sets a new password and gets into his account. No record of the new password is left anywhere. An attacker with access to the email account can still compromise your service, but now he has no idea what the old password was.