Security-wise, this is not worse than having a "recover password" link that, given an e-mail, will send you your username and a new random password (and much be

Security-wise, this is not worse than having a "recover password" link that, given an e-mail, will send you your username and a new random password (and much better than such a link that sends you your chosen password.) For bonus pointw, implement HTTPS and SMTP STARTTLS. I expect that some people won't be too happy about having to dig the link out of their mail, but that's fixable by allowing user/password as well.