little confusion here, the new password is sent by email, but only activated if the user validates the change by clicking on the link in the email. so as long as the hacker didn't get access to the user email, he can't change the password. If any password is sent over email, it must immediately be ...

To the people who can't log in with the new password: Make sure you're clicking on the confirmation URL that's in the same email as your new password. I missed this at first. To Opensubtitles, you should really consider improving your password reset also. The password is sent unencrypted in plain te...