If a user has forgotten their password for a service, the convention is that they should need only their username and/or registered email address in order to reset their password -- in our case that means have a new, randomly generated one sent to them.
But, shouldn't services require a confirmation (such as emailing a link to the user) before sending out a new password, in order to verify that it is the owner of the account requesting the password reset?
Usernames are often public information, and email addresses are easily guessed if you have enough information about a person. Without a confirmation, it would be very easy for someone that is not the account owner to reset someone's password for them, which would be a nuisance.
I have seen web services seek confirmation first, and others that simply throw out a new password, regardless of who requested it.
Should we require a confirmation before resetting a password? Are those that don't require a confirmation doing it for a valid, user-friendly reason? Or are they just lazy?