I have taken over a site built in C5. I am not very familiar with the structure of things.

One thing I have been asked to do is change the way the Forgot Password form is working. Currently, the form is being mailed to an individual who has to manually re-set the password then email the client that is has been reset. I know this is not the normal behavior for a C5 password reset form (at least I hope).

I have spent a little time looking at the site and it seems to be hacked to crap by the person who maintained it before.

Can someone please point me in the right direction on how to fix/add a correct password forgot form.

Thanks :)