inc/special/lostpassword.php
Used by the lostpassword action.
Provides the form send a new pasword to the user.
The username is the email. The mail is sent an the hash for the new password is added as _newpass field. The old password is still valid. But once the new password is used, the old is removed. (see the validpassword function in inc-user.php.)