I can just set a new password and then log in with it anyway. Don't make your users jump through hoops.