It should’ve been sent via email to the registered email address. That lets the account owner reject it (I didn’t request a password reset!) or use it.