Shouldn't this scenario also:
 - receive the new password and activation key
 - activate the new password
 - make sure that the old password can not be used to login
 - make sure that the new password can be used to login
?