code: public function passwordRecovery(array $data) 
      {
  		$main = $this->getServiceLocator()->get('neobazaar.service.main');
  		$userRepository = $main->getUserEntityRepository();
      	$form = $this->getServiceLocator()->get('user.form.passwordrecovery');
  		$form->setData($data);
  		
  		if (!$form->isValid()) {
  			throw new \Exception(serialize($form->getMessages()));
  		}
  		
  		$data = $form->getData();
  		$email = isset($data['email']) ? $data['email'] : null;
  		
  		$user = $userRepository->findOneBy(array('email' => $email));
  		
  		if(null === $user) {
  			throw new \Exception('No user found');
  		}
  		
  		$userModel = $this->getServiceLocator()->get('user.model.user');
  		$userModel->init($user, $this->getServiceLocator());
  		
  		// What's this? When the user will visit the link sent via email
  		// we will check if the passed hash is equal of the current bcrypt hash 
  		// passed on shai. So the link will be always valid until password changes 
  		// or the hash will be updated even for the same password.
  		$hash = $userModel->hashId . sha1($user->getPassword());
  		$url = $this->getServiceLocator()->get('ControllerPluginManager')->get('Url');
  		
  		$event = new PasswordRecoveryEvent(__FUNCTION__, null, array(
  		    'user' => $user, 
  		    'form' => $form, 
  		    'hash' => $hash, 
  		    'email' => $email, 
  		    'siteurl' => $url->fromRoute('home', array(), array('force_canonical' => true))
  		));
  		
  		$this->getEventManager()->trigger(__FUNCTION__ . '.pre', $this, $event);
  		$this->getEventManager()->trigger(__FUNCTION__ . '.post', $this, $event);
  		
  		return $user;
      }
docs: Send a password recovery event if form is valid
  
  @param array $data
  @throws \Exception
  @return UserEntity