By default, it is the user who has to recover their password by using the automatised system (see section 3.4 in the Author manual).
However, in some cases, the password has to be restored manually (for example, if the email address of a user is incorrect, the user does not receive the email that is sent automatically for recovering their password).
...