Arguably, sending a one-time password over email in plaintext isn't a disaster. It's stored, fine, but it's no less secure than the user's email account (that you were going to reset to anyway). If internal storage on the site is still responsible, it's not a huge concern.

Of course, a truly healthy system also wouldn't allow email-only resets, but that's life.

Fortunately, the mail is not typically stored in the user database, so acquiring it would take at least a separate leak.

By you, right? Or is it common practice to store outgoing mails?