Put the user into the token or not, it doesn't really matter for all practical purposes so long as the entropy is high enough.  

UUIDs guarantee uniqueness rather than randomness which was where most of my (initial) complaint lay, because you could trigger a couple of resets and potentially figure out what the next reset code would be.

Now that we're using pseudorandom numbers for the token, it's possible (though unlikely, particularly with a longer key-length) that we'll have uniqueness issues (by their nature they can't guarantee uniqueness).  Online services that use just a GUID, or otherwise don't lock the token down to an account when using random but nonunique tokens are doing it wrong IMO.