On a couple of projects I have, I just check a value only known to the user (ie. birthday) against the row, then email a random password to the email associated with the account. I set the random password into a column that is set aside for this purpose.
If the user visits through a special link in the email, the password is reset to the random password, otherwise it is left as is.
If the password is reset, the user is directed to the profile page, where they can reset the password to what they want.