If there is an alternative way available to reset passwords, support that one. If there is none, either lock the account, or give access to the handle but "delete" its contents.