Here is the code logic you should use to enable password reset as described:
1. In PasswordReset.aspx, call Membership.GetUser() to retrieve the user.
2. Call Membership.GetPassword() to retrieve the user's password format and secret
question/answer.
3. Display a form to collect the user's answer to their secret question.
4. Validate the secret question answer by calling Membership.ValidateUser().
5. If valid, display a form to collect the new password.
6. Call Membership.ChangePassword() to update the password.
7. Send the new password to the user's email address.
8. Redirect