Correctly handle recovery of users with invalid passwords