Off the top of my head, I'd probably consider the following options in order of decending useful/goodness: * Ask for the email address at signup, store a hash, then at reset ask for it again and verify that the hash matches * Ask for/store some other allowed information, then verify that the user wants a reset through that (confirmation code): - Eg collect a phone number and do password resets via SMS/call people who want their password reset - Eg collect a domain and require them to publish a file/txt record that has their email address to send a reset * Give the user some token (eg a specific file). If they can provide the token, allow them to change their password * Get the user to authenticate themselves with a client-side certificate or password. Allow reset only when the user's logged in (ie if they have the certificate or previously knew the password) * Ask for/store some other allowed information, then provide the reset link through that (eg twitter DM or FB account)
The exact nature of your application would probably drive what you would want to do reset-wise. If it's for privacy reasons, obviously some of the ideas above wouldn't work (unless there's some legislation that explicitly excludes capturing email addresses).