Being locked out is recoverable.

A reset link goes to the address on the account, works once, and expires in twenty minutes. Nobody else can change a password, and an attempt leaves nothing behind in the database.

• Only a hash of the link is stored — a copy of the database cannot be used to sign in.