yep, I was thinking the same. User informs email. System sends a code. User uses the code and log in. No password. Transparent validation.