Secure way resetting forgotten XMPP / Jabber password

_x000D_ _x000D_ I'm maintaining a XMPP / Jabber Server using prosody (nightly build). The registration module is activated and user are allow to create new accounts via the xmpp registration. A user contacted me about how she*he could reset the forgotten password. The problem how to identify the user. (It is no problem to reset the password via prosodyctl). Ideas: check the users roster / contacts and she*he has to verify 1-2. (But what if the roster is empty ?) add an email in your profile but it's not obligatory (At this point not sure how read the added email) I would like to write a script / tool for the webbrowser to allow the user to reset the password, but how to verify and with which information ? Is there any standard for this or some experience ?