I think it's important to check that entered email addresses actually belong to one of your users before you send the recovery email. Assuming that your sign-up form already collects email addresses, it would be silly not to make use of them to perform this simple check.
Without verification, one major concern would be spammers/hackers entering tons of made-up, invalid email addresses. This would cause your server to send many messages that bounce, and draw attention from spam filters and spammer databases. Eventually, your server could get blacklisted, and no emails from your site would go through anymore.
Plus, mistyped email addresses are quite common, so you could have instances where a user accidentally sends a recovery email to someone else's inbox.
Without additional information about your implementation I can't really point out any other issues, but in phase 3, there are some additional security measures you can consider. For example, you need to make sure that the recovery URLs are long and random, so that they cannot easily be guessed or brute-forced. You also probably don't want the URLs to be active forever; it's a good idea to expire them after an hour or two if a user generates a recovery URL but never actually visits it, or if the user visits it but never provides a new password. To further reduce the chance of a hack, you can completely disable the password recovery feature if the account was used within the past few days, or if the IP-based location is atypical for that user (though these measures may inconvenience users).