okay -- that makes sense to me -- but isn't there functionality to have a newly minted password created and emailed to the user by simply using the <asp:passwordrecovery /> control?

or is there more to it than that?

I'm having trouble finding guidance on this subject ... any ideas?

Have you tried the password recovery control? 
http://msdn2.microsoft.com/en-us/library/system.web.ui.webcontrols.passwordrecovery.aspx

It supports resetting and sending a new password when the stored passwords were hashed:
http://msdn2.microsoft.com/en-us/library/ms178335.aspx