I am also a data protection officer and attach great importance to security on the Internet.
In the additional information (user profile), I would store a kind of security response that has to be entered in the form. A word or a number, perhaps. In any case, something that cannot be guessed.
+++
This might need a 2nd step by mail. The user should provide this. So he/she can remember this.
+++
If everything is correct, send him a new password and a new security response.
One more hint: For the login you don’t have to use the newly appeared page “User Login”. However, it must exist and be published.
Login forms can also be added on any of the website pages, but a standalone login page needs to exist: it’s where visitors will be sent to authenticate, if they access a restricted page or asset.
An elegant solution would be to put the login form in a popup (modal / lightbox) and open this popup when a button is clicked. Tested and it works fine.
Mr. F.