The password hash itself (I assume $user['password'] is not a plain password but a salted hash) should be "secure" already. As long as no one knows the salt, brute forcing should already be quite a job with a salt length of 32(?) character. Adding up the extra layer of md5 + microtime and str_shuffle around that hash ... you really think that this could be brute forced "very rapidly"? The amount of permutations a hacker needs to try in that scenario sounds almost unlimited to me, but I have to admit that I am neither a security nor mathematic expert.

But at the end I might be wrong just from the point of view that there is no big security risk in a password reset function. Access to email account is required as well ... so I don't mind if you just ignore my comment ;-)