Issue a key that must not be lost (big blurb print this page and keep it safe)after they enter initial password, if they have the initial email addy given to start the account and the initial key then change their password else call customer support.
thanx,
bill