ErkanaAuth (v2.0) - blank username gets authorised??

[eluser]nevsie[/eluser]
Hi Michael,
Please do not rush anything out for me... i have thumbed my way through and have a fair idea of how it all works and the learning experience was great. However, from a newbie point of view i kind of started with the Heuristic Blog walk through of Erkana V1.0 and this is a little out of date.
I think you will get a lot of traffic if you do somehting like a tutorial for it though!!!

As a side note also... the next step for me is the forgotten pass / registration functions. Do you have any tips for these?
On the forgotten pass side of things i was thinking of checking username or email address, and then sending an email out with a link to a verification page. The link back would go to a verification function which would pass back the email address and a hash of email adress plus the sites salt key and id, or similar. Therefore i can check the hashed string against my results again and permit them to change the pass. Is this reasonable or do you / others know of better methods or practises?