It would be better if the website allowed the user to set the new password first and then send an email to confirm the password change.