Allow the user to sign in with their password, if they cannot remember their password or would rather sign in with their email then allow them to receive an email containing a token that logs them in. From their account settings they can change their password.
This is already how most websites work isn't it?