The whole password reset function worked for me with a test user so I believe it is probably a desk-side issue.

There are also timing issues here.

Locked for 15 minutes is locked for 15 minutes irrespective of non-admin password resets, and I'm not sure how long the security token for the reset is valid for so there are a number of things that could be affecting this.