The service (called SSPR) relies on the user pre-registering their mobile phone number and or an external/personal email address, which will be used to verify the users identity during a reset request but not a password change
This does require all users to register their details with the service before they can use it