Kind of a tough problem since you don't give an email address when you sign up. You just pick a username and password. I can't really think of a reasonably secure way to deliver a new password in that scenario.