Confirm who is asking
Check the request comes from the email on the account. If it does not, treat it as a possible takeover and follow your verification steps.
Work through the common causes
Wrong email, an old password, a lapsed single sign-on link, a typo in the address and a blocked email are most cases. Ask one question at a time.
Send the reset yourself only when safe
Trigger a reset to the address on file. Never change the email on a request you cannot verify.
Explain what to do next
Give two or three steps with no jargon, and say what to do if the reset email does not arrive.
Record the cause
Tag the ticket. A cluster of the same cause points to a problem on the login page worth fixing.