It's very like 3, but the URL is required to "follow-through" on the reset.

Incidentally, EzBoard uses #2. I occassionally get emails from them with my current userid and password; usually whole months go by without any. I think the most I ever had was 3 in one week. I figure most of them are people trying to register the same userid as me and not realizing that EzBoard has told them "it's taken - pick another".

Wade.