Have you confirmed that performing the password reset request invalidates the current password? The way I've seen this done is to have two password fields - one

Have you confirmed that performing the password reset request invalidates the current password? The way I've seen this done is to have two password fields - one for the normal password, one for temporary passwords. Issuing a reset won't lock out the "normal" password until you log in and change it. If someone gains access to your email, it's game over anyway.