some poeple click on "Forgot your password?" and write a subdoman only to #&¤#%& with the owner of the subdomain.
Cant you add some confirmation in the mail? "If you have forget your password, click _here_ to get a new password".
Apart from this(and your poor template system) i just love the script.
// Pontus, Sweden