how are the "Encrypted email return set" and "Encrypted email return success" access rules configured?
could be an issue with setting session variables.
Add the following code to the forgot password page just after the <body> tag to help troubleshoot:
<pre><?php var_dump($_SESSION); ?></pre>