Password resets follow the same secure email flow as administrators.