The Disconect is this:
You had asked for my opinion on whether I thought your method was the right way to do it. I dont. I offered an alternative method and steps to achieve it that you discarded in favor of doing it the way you initially set out. Now you are trying to fit my steps to your method.
using your method, you will not be able to use one page, you need to use multiple pages.
From your description of the process I can tell you understand how the page needs to be processed, your just thinking to hard about the steps I outlined for the alternative method.
The one form approach allows you to limit it to one page because they are selecting the question when entering the email. If you want to display the question, you cannot use one page, you must use two.
On the first page, you enter the email, on the second page you use a recordset to lookup the question and display it, then they can enter the answer. you use another recordset to look up the answer, if it matches, send the password.
you can use what ever steps you like. At the end of the day it just boils down to creating filtering recordsets based on user input and acting on whether the recordset is empty or not. you chose the workflow that works for you, and then create the recordsets to make it function.