If they follow the password reset link we log them in and tell them to change their password.
Also once a password reset code (or confirmation code) is used, forget it.