Define format for auto generated passwords

We have a requirement for a CB2 site that the password must be a pin number of a specific length. I can enforce this on registration using the options in the password field but if someone uses the forgot login feature, the new password generated is alpha-numeric.

Is there any clever way (eg. using auto actions) to intercept the password generation mechanism and change it to a format and length that we define? Or maybe after the new password has been generated but before the new password email has been sent out, update the password, suppress the automatic email and send out our own email? Or would I need to hack CB to do this?

Many thanks

CB doesn't generate the password. At most CB can specify a length. We directly call the below Joomla API for generating passwords.

JUserHelper::genRandomPassword( $length )

This is done via the getRandomPassword CB user object function. The Joomla function doesn't allow customization beyond length though so I'd imagine you'd just make your core changes in Joomla if you want strict characters/length.