Its possible this is a result of 'robots' or search engine crawlers submitting the 'forgot password' URL. To guide them as to what not to crawl, you have can have a robots.txt file. This file should be located in the base directory of your website.
If you already have a robots.txt file, add this to the bottom of it:
Disallow: /authors/forgotpass
If you don't have a robots.txt file, create one in your base website directory with the following contents:
User-Agent: *
Disallow: /articlerss
Disallow: /authors/forgotpass
Disallow: /blogrss
Disallow: /tmp
Disallow: /attachments
Disallow: /cache
Disallow: /newsrss
Disallow: /newsrss.php
Disallow: /blogrss.php
Disallow: /articlerss.php
