You can use the hide email address taken admin setting, which would then require the full email for password reset requests:
Advice on creating a password for your email account would be out of scope for this forum, though I’m sure you’ll find some good resources offered by your email provider for that. 