Manual:$wgPasswordResetRoutes

Access: $wgPasswordResetRoutes
Whether to allow password resets identified by various bits of data.
Introduced in version:	1.18.0 (r86482)
Removed in version:	still in use
Allowed values:	array
Default value:	array( 'username' => true, 'email' => false ) array( 'username' => true, 'email' => true ) (since 1.26)
Other settings: Alphabetical | By function

Details

Whether to allow password resets ("enter some identifying data, and we'll send an email with a temporary password you can use to get back into the account") identified by various bits of data. Setting all of these to false (or the whole variable to false) has the effect of disabling password resets entirely.