We send password and ask user to change it. It is not super secure if person doesn’t change or user email is compromised but alternative is much worse people tend to loose or don’t backup keys properly.