It's important to use the most recently received link. If you reset multiple times, only the last link will be valid.
If this still doesn't work, a user with superuser access can create a new password and inform the user. Subsequently, the user must change it to their own secure password