In most SaaS password reset flows, the actual reset of the password does not occur until the user clicks on a link received via email. This link prompts the user to enter a new password. (Salesforce, for internal users, takes the extra step of asking the user to answer his security question.) If the user doesn't ever click the link in the email, the existing password remains intact.
The password reset flow for a Community user is different, and not in a good way: as soon as the user clicks on the button after entering her email address/username in the form, the password is reset to some unknown value. In other words, the user is completely unable to login until clicking on the link sent in the email.
This means that, in a Community, someone with knowledge of usernames/emails (someone else in the Community?) could come along and reset everyone else's password. Not a big security threat, since that email link is required to actually get a new, known password, but a major possible UX disaster.
Am I correct in my diagnosis, and is there a way to make Communities password reset behave more like the flow I outlined in the first paragraph?