My users are getting password reset emails they never asked for

That is somebody, usually a machine, typing their usernames into the lost-password form. Each request makes your site send a real email, and until the password is changed through the link nothing has actually happened to the account, so the emails themselves are safe to ignore.

Limit password reset emails, under Settings → Guessing at passwords, is what stops it. It is on by default: three emails an hour for one account, however many addresses ask, and five requests an hour from one address. While it is on, an address locked out for guessing gets none. The Password resets tab on Who has tried shows the reset emails that were let through, the requests that were refused, and the addresses they came from.

If a real customer is refused, their account has already been sent reset emails this hour, and the newest one still works. It may be in their spam folder. An email your site reported it could not send is not counted, so somebody who kept pressing the button while your mail was broken is not held up once it is working. To let them ask again straight away, press Let in on their row in that tab: it starts the count again for their address and their account. You can also send them one yourself from Users → All Users, which is never limited for an administrator.