with my testing,
i do not "enable password retrieval " at admin area,
but "Recovery Email Address" does not be hidden at end user aside,
is it normal ?
Trouble logging in? Simply enter your email address OR username in order to reset your password.
For faster and more reliable delivery, add email@example.com to your trusted senders list in your email software.