Bug fixed in 1.4.6 (
IP-401) has found its way back in to the 1.5x code.
The "Password Reset" function does not honour configured mail settings, and defaults to PHPMail. This requires (secured) systems to have an alias created for "email@example.com", which is not an option for some VPS solutions.
Therefore, I'd suggest this is a "critical" issue.