Password reset help needed

I have the enable password reset set to yes, and this works fine, however there is a problem. I have payment required before login and this works fine.

Here is the problem, if a person goes to pay at paypay then cancels the payemnt, they cannot log in, when they try to login they get a pending message wich is good, but if they then choose to change their password, all of the sudden they can login.

I work around this by not enabling the password reset link, but I would like to make it available. Is there a code snippet or something I could add than would stop the person from being able to login in before payemnt if they change their password?