And that's fine.

If a user forgot their password, they shouldn't be calling support unless the reset password flow is breaking somehow.