Generate a one-time reset code for .
Give the code to them - they enter it on the login page with their new password.

Share this code with . It expires in 15 minutes and works only once.

They go to the login page -> "Have a reset code" -> enter username + code + new password.