We use email as part of a password reset process because in many cases there is no good alternative. However, all password reset procedures which use email are not equal. Some are definitely better than others. As other forms of communication become more common, you will see password reset procedures move towards using these newer technologies as they are ofte more secure (or appear to be more secure) - for example, more of the systems I use now use SMS rather than email for password recovery.
Part of the reason email resets are insecure is because passwords in themselves are inherently insecure. If you augment standard passwords with something like 2-factor authentication, the risks associated with email based password resets can be reduced because the email has only part of the information required to access the resource in question.
The other point to consider when evaluating the security aspects of email being used in password resets is impact versus convenience. I really don't mind if that web site I use for tracking my grocery shopping list uses an insecure email based password reset procedure, but I do mind if my bank does (and yes, I have different passwords for each site).
Of course, there are good and bad email based password reset systems. Those which actually send you a new password are less secure than those which send a special reset link. Those which have a link which is one use only and are only valid for a limited time are better than ones that last forever or can be used multiple times. Those which are random and non-predictable are better than ones which can be derived based on some easily obtained information.
What should happen is initially we do a basic risk assessment - look at the likelihood of a password reset mechanism being compromised and the impact such a compromise would have. If the result is acceptable, the process is OK. If not, then the process needs to be modified until a satisfactory compromise is met. However, these compromises will likely be reflected in lower levels of convenience, so you need to be realistic in your assessment of both potential/likelihood of the process being exploited and the impact such an exploit would have. Over estimate either and you could end up with an over engineered and inconvenient solution. Under estimate and the process will not be sufficiently engineered to provide enough security - it will likely be very convenient and easy to use, but will expose the user to too much risk.
Bottom line, email is insecure, but if implemented well, an email based password reset process may be a good balance between secure enough and convenient. If you don't think the email based password reset facility of a service you use is sufficient, don't use the service.