The first mail is generated and sent successfully. The user receives the mail and clicks on the link.
The request is handled by the web server with a status code of 200, but no mail with the new password is handed over from the default PHP mailer to the SMTP server (nothing in Postfix' log).
Further requests to the same link are handled by the server with a status code of 307 (redirects to start of forum).
Oddly enough the password forgotten flow works fully when I try it with one of my accounts.
I'd be thankful for any advice where to look further in order to narrow down the problem.