Thanks for the advice. I should've mentioned that this is a subscription based service we are offering so security is very important to us since it affects our main customer base. I should've also mentioned that we can't send them the password they created because it's encrypted when stored in the database (SHA-1). Our approach is very similar to what you find on something like Paypal (not quite as stringent as theirs though).
The problem with simply generating a password and sending it to them is that anyone can pose as the person if they know their email address and cause a new password email to be sent to the user. It's a lot easier to ask the user that forgot their password a simple secret question and they supply the secret answer. It's a bigger hoop for the customer to jump through with changing their password when they didn't request it, than it is to pass a simple security test.
If it's a poser, they will probably fail the security answer test which means the user will never be bothered with unrequested emails that will only cause confusion and phone calls to our help desk wondering what the heck is going on.
I should have been more clear on the need for the forgot password process being more stringent than simply sending a new password just because someone with an email address requested it.
steve