2
When someone tries to recover a password, an email is sent to the email addy for confirmation that the user actually WANTS to recover the password (first email with first link)
When that link is clicked on from the email, the password is changed to a random one and the new password emailed to the email addy. After that, the user can login with these new credentials.
If it is the SAME email that is sent to the user, something is wrong, but that is not my experience with this, so could you double-check, please?