Generate a one-time reset code for .
Give the code to them — they enter it on the login page with their new password.

Share this code with . It expires in 15 minutes and works only once.

They go to the login page → "Have a reset code?" → enter username + code + new password.