Passwords are encrypted in the databases and there's no way to recover them if they're forgotten. Instead, users who have forgotten their password are instructed to contact the webmaster and request a new one to be set.
Before setting a new password, the webmaster should check that the user requesting the reset is who they claim to be. In the ideal case, the user would:
If a request is received that is lacking any of the above, the webmaster should use their own judgement when deciding whether to proceed. Note that if a valid season ticket is quoted but it's ICU number doesn't match the user's, then the request should be regarded with suspicion.
There are two ways of reseting the password, differing only in how long before both websites (www and ratings) acquire the change.
The quickest way is to perform the reset from the ratings site because, immediately after the change is made, it's synchronized from the ratings database to the www database.
This method will update the www database immediately but the update to the ratings database won't happen until the hourly sync runs. If you use this method, warn the user that their new password won't work on the ratings site for an hour.