I will have to check with the developers on this, but yes, I believe the Forgot Password email comes from the primary install address. However, having that come from the primary Brand email address is a better way to handle this. If that's not the case, I'll pass the info along for a future build as that's a good idea.