use the recoveryPassword var instead of accessing the POST array

We shouldn't access $_POST[] here... issue #3480