Never give a password or reset a password, find the account name (either by their email address or the username they're asking for) via the control panel and click the "send password" link; it's a secure way to get them a new password and if they didn't request it then the old password will still be valid.