A configuration option to disable "Forgot Password" should be provided. Users can call the helpdesk to request for a password reset.