Give the address your account uses and a link to set a new one goes to it. The link lasts an hour, and only the person reading that inbox can use it.