That sort of data belongs in an analytics or event database (ie. one with entirely different requirements from your normal database). Usually when I implement

That sort of data belongs in an analytics or event database (ie. one with entirely different requirements from your normal database). Usually when I implement a stateless approach like this I still fire off a log event every time we generate a password reset.