No, it didn't work! I don't know why though.
In the end I decided to create a session using the email address data which is populated before page load. I then used the session data in the email link.
At the moment it seems to be working, but it's odd that the email template is able to pull data referring to the random password and the user ID, but not the email address! Just in case, is there anyway that you know of how the session could loose it's content while on the userupdate.php page which then prevents the email link from working again? Is using a session instead of the recordset pretty much bullet proof?