Don't Delete Password Hash

In the event someone else triggers the forgot password action that wasn't the user, it shouldn't delete the hash. and lock them out.

(modifying via webui, as example)