You need a multi-level verification process. Since your platform works with bills and other pieces of confidential information there is a lot of data that you can use for this purpose (a combination of these pieces of data is required to prevent abuse) - real name, bank account number, serial number of last purchased utility, phone number, zip code, complete address etc.
Some of this information can be requested from the user upon registration like real name, zip code, phone number etc. Many web sites allow the user to give an answer to a question from a set of questions (trivial ones: what was your first pet's name?, where did you go to school? etc.). Multiple such questions will reduce the risk of someone guessing just the answer to a single question and then gaining full access over the account of the user.
No matter what you choose you have to cover two steps:
- Retrieve user's email address - this is where most of the input goes (answering secret questions etc.).
- Reset user's password - send the new password to the email address that user has given
Some times it happens that the email account is no longer valid (account has been closed either by the user himself or by the email provider for some reason). In this case you need to make sure that the user can change it! This is where the confidential information you have about the user also can come in handy.
Last but not least you can always think about sending a sealed letter with a code inside (some banks even make PIN numbers send via post "self-destruct" by using various chemicals that make the ink disappear after a very short amount of time (often just a few minutes) when it gets in touch with air or liquid). Naturally this will cost some small sum which you probably will have to bill the user for.