when a user resets a pass, the link provided in the autmatic email looks like :

http://buddypress.org/wp-login.php?action=rp&key=8Dwc0nZ97EEd2GZY8dD6&login=user>

so guess what happens when you press that link with extra “>” at the end ;)