This is a bad idea.
Digimanus is correct, I could give your system your user id, and a Ten Minute Mail email address, and you would send me your password. Then I could log in as you and do anything I wanted.
There are two (at least) problems here:
1) I could get you password without you knowing. Since people tend to use a single password for multiple systems, this is very dangerous.
2) You are storing passwords in a easily retrieveable format.
Do not do either.
Operate this way instead:
1) Store password hashes instead of text - because they cannot be decoded back to the original password, they are much more secure (they also have a fixed length, which helps with the DB design). There is a Tip here that should help:
Password Storage: How to do it.[
^]
2) Require your users to enter a valid email address when they register. (You can check it by sending a confirmation email which they must respond to before they continue).
3) When they forget the password, reset it to a random value, and send the new random value to the original email address.
This means that the original password is never known - except to the original user. So if he uses the same password for all his systems, then they aren't compromised either.
Submit an article or tip