I would use the current users password hash from the database, combined with microtime():
Something like:
```$passwordResetHash = str_shuffle(MD5($user['password'] . microtime()));```
The current implementation is predictable and therefor a security risk.