I guess it's better to let players set secret question instead of email. We will encrypt the answer right after the player enter it. About the email, I've to say that most of the players dont even have an email/use random email accounts, so the email feature will likely be used by only few players. Moreover, there's also a possibility of abuse..such random players spamming 'forget password' and make server spam the real players'/someone else's email account or problem with not receiving email..etc. This will probably get us more works and troubles than resetting player's pass which only takes few mins. So, i guess the secret question is a better choice and it can also be used by more players, besides it's easier to use
Edit: There's another problem, if the player use question that can be guessed or known by other players. It's not worth to risk players' account for some little work. I've come to a decision, this idea will be denied.