An alternative approach:
Have the user provide the email address they used when they registered
Verify that email address does indeed belong to an account (report an error if it does not)
Send an email to that email address with...
...a new password that is auto-generated (dictionary words are better then random characters) and expires after a set period of time (let's say 24 hours)
...a message that this new password was sent as a request from your website and if they didn't request it to ignore that email
...the URL they need to visit to re-login with their new password (make sure this page validates against the temporary password and not their actual password)
- After they login take them to a page where they are required to update their password to one they will remember (you can't show them their actual password because you hashed it, right?)