You can actually copy the rendered code from the password reset form to recreate it in any template.
<div id="content">
<form id="forgot_password_form" method="post" action="http://www.mydomain.org/" >
<div class='hiddenFields'>
<input type="hidden" name="XID" value="3a451c89545c8d3044192ebd6aeb00c5114d2e04" />
<input type="hidden" name="ACT" value="11" />
<input type="hidden" name="RET" value="-3" />
<input type="hidden" name="FROM" value="" />
<input type="hidden" name="site_id" value="1" />
</div>
<table class="tableborder" cellpadding="0" cellspacing="0" border="0" style="width:560px;" align="center">
<tr>
<td class="profileHeadingBG" colspan="2"><div class="tableHeading">Forgotten Password</div>
</td>
</tr><tr>
<td class="tableCellOne" colspan="2">
<h3>Your Email Address</h3>
<p><input type="text" name="email" value="" class="input" maxlength="120" size="40" style="width:100%" autocomplete='off' /></p>
<p><input type="submit" value="Submit" class="submit" /></p>
<p><br /><a href="http://www.mydomain.org/subscriber/login">Back to Login</a>
</td>
</tr>
</table>
</form>
</div>
Is the relevant portion of the code, though you probably want to at least explore the styles in the original, as well. I believe this is one of the forms, where though an XID is generated, but the security risk isn't that high if it stays they same.
If you're very security minded, then you can use a number of add-ons to get more control, and they'll make sure a new XID is generated every time the form is called. You could also create a php script that generates an XID.
I've used Solspace's User, Authenticate, and Zoo Visitors to handle the creation of registration, login and password forms before. But I recall that in the first project that I had that actually required a custom members area (most of the sites we develop don't), we tested the password rest form and decided the code grab-able.
It's been awhile, but I think we looked to see if the XID was being used to identify the user, but for the site, the front end only used cookies and since the user hadn't logged no session was in play and the other security risks were minimal. Granted, I don't recall, what the other security risk were now. That was +5 years ago, I believe. Right before add-ons customizing the member templates started to show up.
Update. Remember to copy the code from your solution. I do believe whatever you use for the XID needs to match your system, but I could be wrong.
EDIT By Anna Brown
You can use {xid_hash} to generate a unique hash per page load.
