The way you mentioned can be achieved by SDK coding, where you have to add a webpage which can store details of users,password and their secret question, answer
Meantime you can check the following which is self-server password reset utility from B B Downloads
B Downloads
(BOB member since 2007-08-16)