There's a few good resources on password usability.
Sitepoint has a great list of points when considering a password system, most importantly:
It can often seem like a good idea to allow users to include a hint to help them recall their password. However, this can be a little bit dangerous: users might simply enter their password (or a derivative of it) as the hint, or employ a hint that makes guessing their password all too easy. If you do want to use password hints, think about asking users for some additional information before displaying it, such as their ZIP code or date of birth.
Hints and Security questions are often too obvious (Password: Babies Hint: Babies) and if you have a set security question(s) a user might have no good answer, or the answers might be too obvious. Ask me my mother's maiden name? Everyone that knows me knows my answer! Ask my favorite Pizza place in Brooklyn? Um...what did I pick for that answer again?
Sitepoint also says this about password resets:
It’s a good idea to enable users to reset passwords themselves. That way, there’s no need for intervention on your part. Typically, this is done by sending a password reset email to the registered email account. The user clicks a link in the email, is directed to your site, and asked to set a new password.
It's hard to get a more pleasant experience than clicking a link to reset a password. No memorizing, no guessing, all I need is access to my email. This also avoids sending a password via email (which Sitepoint recommends against), which can be problematic if the user never changes that password and or if someone intercepts the email.
Perhaps beyond your scope, but a lot of people consider the whole system of password resets for common accounts to be a bad experience. Jonathan Duhig has a great blog post explaining how to cut out the "password" problem entirely; OpenIDs. Things like Facebook connect mean your user will never forget their password or username or hint or whatever--their security is simplified and you've torn down a number of barriers on sign up to boot. This is the ideal experience, if a user is willing to connect their OpenID to your site.
It's also important to note that asking for a password hint or security question is an extra step in signing up. Email password resets only affect users that need their passwords reset, asking questions on your sign up form affects all of them.