For some sites I do users need simplicity more than that level of security the current procedure feels cumbersome for a smallish site - ive got around it by storing passwords unencoded in a separate column. I know purists will groan but its what the client wants (and in this case I agree with them).
The problem is its not really two steps,
step 1 fill in email (thesite.com)
step 2 click reset password (in email system - go to thesite.com)
step 3 get new password (back at email system - go to thesite.com)
step 4 change password to new password fill in ugly password (at the site.com)
(step 5 get new password in email system)