In MDL-66984, an interim solution has been accepted to flip-flip $USER, until a better API will be created. 

The main problem here is that the very same method change_password_url() is used both for change password (with the user logged in) and forgot/reset the password (with the user not logged in). There are, at least, 2 different approaches to fix it:

• Stop relying on $USER and add a $user parameter to it, so it works independently of the logged-in status.
• Split functions and use a different one for each case.