Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform POST requests, and asking the user to retype the token is not an acceptable experience. However, this puts the token at risk of leakage through the referer header.
One potential solution to this is to avoid any external links on the password reset page. However, most sites have a standard template that does include external links (Facebook, Twitter, etc.) and not using this template would make the page look odd - and potentially make users think it is a phishing site.
It seems browser vendors are aware of this issue and some browsers support the meta referer tag, which can be set to "never" so the URL is never leaked. However, not all browsers support this tag, so it is not a complete solution.
So, how do you create a password reset process that does not have this leak?