in the database the table would have a layout something like....
[UserName][Password][Email][fName][lName]
on login you would validate password against userid... you would need to store a variable somewhere- either a cookie, or pass it back, or something- there are countless solutions...
once that user has maxed out the attempts, or clicks the 'I Forgot' button you will simply ask for their username, validate that that user exists, something like (select [Email] from tbl_Users where [UserName] = @param) and then use something like
this (google java email) to send an email to that person with whatever details you want.
Before you post, read our: 
