Answer
If an user is willing to let you know her/his password, you can change it for her/him (See Question 1).
However, the best way is to let the user access a program of yours that performs this duty.
You may use some WRKVLDL existing code, see topic How can you let a user change his password.
Note - You cannot use the WRKVLDL utility to change the password of a validation entry previously created or updated
through *ADMIN HTTP instance. The reason behind it is that the utility requires the user to enter the current password for a check.
However the WRKVLDL utility is not able (because of different encoding) to retrieve the correct value for the current password of an *ADMIN managed validation list entry,
and the required check would fail.