I've been involved in discussions with a number of customers recently around this very topic and (without exception) everyone has given me a flowchart that is flawed in some way.
People, this problem has already been solved. Why do you want to re-invent the wheel?
The inestimable Troy Hunt blogged on this a while back - Everything you ever wanted to know about building a secure password reset feature .
There's a flowchart at the end of the post which gives a good overview of the type of system that you should be designing.
I used this flowchart as a discussion point against the various "models" I was presented with and in each case, we discussed what was missing and the risks associated with that.
Ultimately, the customer makes the choice - but it's always worth having the discussion so that they are as informed as possible.
And always write down your recommendations so when things turn to custard and the finger points at you, you have something tangible to fall back on.
BTW - you could use most of this as a "Change Password" guide.