> And a user who knows the mail or username of an Piwik user can lock him out by just recover his password and set the password to some rubbish. No, it is not possible. Before the password is changed, the user will have to click the link in the password reset email. IMO we don't need this feature in core, so i'm closing. However disabling password reset could be done (I think quite easily) in a small new plugin.