Any Administrator may reset (i.e. delete) any users password. The user may login with an empty password then or set a new one at the sign in page.
A normal user may only reset a users password who has his email address defined. For users with undefined email address you have to ask an Administrator to reset any password.
Authenticated users should change their passwords at their UserPreferences page.
Attention: Certain external authentification methods don't allow changing passwords. You'll have to ask or change it there then.
