Sending user passwords in the clear

[eluser]Thorpe Obazee[/eluser]
[quote author="Dregond Rahl" date="1242634729"]i think the better way would be to add a token to the database for lost passwords, when a user requests it, its added, and say something like this is sent to the email in the DB


Lost your password? okie fine fine, go here :

http://domain.com/lostpassword/E6hD5Km9 (randomly generated string)


that page has a new password and confirm password field.[/quote]

but doesn't that present a security issue, someone could manually type in (guess) generated strings?