It depends on how the administrator has configured the Forgotten Password module. Administrators can configure the module requiring users to provide any one or more of the following information for resetting password:
Challenge-response questions
User’s attributes
Email or SMS token