This wouldn't be too hard. You should be looking at events.

You can hook into the the 'on_user_login' event.

The class that gets call would check for a config constant for that user - these can be set at user level - perhaps named 'passwordReset'.

If that config constant exists is true, no action, if not it redirects them to a page where they can maintain their password, which could be custom built or perhaps just the built in member profiles page.

Another event 'on_user_update' could send the email message with the new password.

When done, set the user's config constant passwordReset to True so that all the above only ever happens once.

Have a look here for more info on events.

http://www.concrete5.org/documentation/developers/system/events/...

Hope that helps.