Reseting the password just places the user in an infinite loop. After confirming the email link and creating a new password, submission takes me to: http://www.domain.com/login/?action=lostpassword&error=invalidkey
Also red warning box with "ERROR: Incorrect Password. Lost your password?" link send an email without a verification link.