[alnorth]

Yeah, but you're not introducing a new failure point. Most services already let you reset your password - as long as you can click a link they send to you in an email.

[edwintorok]

If you reset the password the user would notice that he can't login next time. If you steal&delete the email with the one-time login token the user won't notice, so there is a difference...

[ravloony]

Of course, missed that somehow.

With that out the way, this is really interesting stuff, although some people may end up with crowded inboxes.