Jan Dembowski on "Overwrite CORE function for wp_lostpassword_url and message retrieve_password"

I know I can do this by editing the core files

As you already know, that's really a bad idea.

I don't have a solution but try this search.

http://wordpress.org/plugins/search.php?q=password+reset

See how other plugins work with passwords. One of those plugins may provide a hint.