Links sent in plaintext over the network. :(

Potentially, but if you have your password reset process be sending a reset code by email it's effectively the same account access.