A user is getting invalid security key when clicking the link they receive when requesting a new password. The user name and email are correct...as they do get the email with a link for the password reset. When they follow the link they get the error.
This has happened before with others and I ended up manually giving them a password over the email, but I don't like doing that.
Any ideas what is going wrong?