I feel like you have two choices for password reset flows:

1. Insecure ones

2. Ones where many users needing recovery will get locked out with no ability to recover their accounts, guaranteed