The flow as specified in the specs is that only an Admin can register new users. A new user can register itself. That's why the Admin has to get access to the reset URL to be able to send it to the users. That's also why the token is stored for when the user confirms his registration is can be retrieved to be validated.
If that system is too vulnerable we should revisit the whole flow for the next release.