I fully agree with MsM and would also recommend a single password sent via email, that requires a new password to be provided upon first login of the user.

Naturally, if the user responds informing you that they are not able to log in (so someone else logged in using the stolen password, and was then forced to change the password to something different) - at this point you could investigate any security breach. But until this happens, stress less.

CTO