If a user does not remember its password, it must be reseted. A way to do this is by allowing admins to create a new (maybe random) password for a given user. Then the user must update this password.