We certainly want to minimize annoyance of the admin. :-) Security is nice to have, but probably not essential here.

It seems like 3) is the way to go. But maybe try to minimize the potential for abuse by only permitting it to be reset once a day or once a week or something. Asking for the answer to a "hint" before giving out the password is another option, but what if one forgets the answer to that too? :-/

Perhaps cheap biometric sensors will make this moot. Until, that is, we all have Lasik eye surgery and burn off our fingerprints anyway... :-(

Cheers,
Scott.