An employer I worked for would allow you to reset anyone's passwords by calling the help desk, providing their username, and their direct manager.

I told the ciso this and she asked how a bad actor would figure this out, I said linkedin. She didn't seem pissed so I laughed and 5 minutes later reset her password and sent an email to her self as proof.

That policy changed quick...