A password reset sends an email to a patron when executed. The following should be considered: 1) We should allow other delivery methods 2) If a patron doesn't have a delivery method, we should be able to use a method like password expiration, but Koha should generate a code that is put in place of the password. The patron has to put in the code in order to change the password.
The email verification acts as a "second factor". By proving they have access to the email account, the user is verified. Same could be used for SMS/text messages when they need to have access to the phone. I am not sure where a code would come in and how would it be communicated to the user?
(In reply to Katrin Fischer from comment #1) > I am not sure where a code would come in and how would it be communicated to > the user? If staff set the reset for a patron, we are usually confirming the patron through other means (via photo id or questions via phone). If the system sees that there is no email or text, it could generate the code and put it in place of the password, and the staff can tell the patron what that code is. This guarantees that only the person they verified with can reset the password, not just someone that might have access to the link.