I would make an api call that sends them a password reset email. This way you (1) verify their email, and (2) they get to choose their own password.
http://docs.discourse.org/#tag/Password-Reset%2Fpaths%2F~1session~1forgot_password%2Fpost
3 Likes