I often think this is the right way to go. I think even if you type the wrong password, it should ask you then and there to reset your password to what you just

I often think this is the right way to go. I think even if you type the wrong password, it should ask you then and there to reset your password to what you just typed in (confirming via email). This even has the added benefit of the user changing their password more than never.