There are also derived passwords, which are kind of a hybrid. Either as a pattern the human remembers or a manager that does the calculation per domain.

I'd also add that forgot password features at least notify the address owner of every attempt. Password based logins don't always email on every login from a new location.