Reply to post:

Company is small enough, and I do recognize voices plus we have caller-ID to allow password reset requests this way for a forgotten/locked domain account.

Password requests for other systems is done via email.