seeing sometime user came and say they forgot password ,they provide username and get password back.
some players maybe use same username as in game login.so maybe someone lie and get other password.
there should be some verification for resetting password like secret question,email,etc...
also while creating account on server should be required a valid email to verify before new account this way would be possible if someone create new account on same email.