Are you composing your email on your controller ?
You say it's inside genNewPassword, but it seems the instantiation itself occurs somewhere else...
And I believe we should make our effort to keep our methods up to one task, and there, you have at least two.
Generate a Password;
Send and Email;
If you need, later, to generate a password without sending an email, you have to either duplicate, or refactor.
If you need, later, to send an email only, you are repeating somehow.
I'm newbie myself so, I may be wrong.
I notice as well, that this sendMail will depend a LOT of to many factors.
Will we send a user-to-user email ?
Will we send a site-to-owner email ?
Will we call this functionality on several controllers or just one, or all ?
Guess there's no one million dollar answer here...
I will try to look, however, to a service approach. Like: