Before a user can reset their password, they must first enroll in Account Recovery.
For a user to reset their password, they can follow the Forgot Password link which can be found under the login form. Note, if this link is not available then "Password Reset" needs to be enabled.
They will then fill out the following form using their email address and phone number that they verified during the enrollment process.
After clicking reset, they will receive a one time use token via SMS to the number that was enrolled.
Enter the code and click next,
They will then need to answer their security question and provide a new password. If the reset process is successful, they will then be redirected to log in with their new password.
You can also reference the video below to see the forgot password process in action: