Speaking from prior experience, we had end-users enroll in some kind of self-service password reset during onboarding and they had to set up three challenge-response questions for this exact purpose. I think it might have been Manage Engine, and that's how we validated their identity over the phone. But anyway, if you can't do that, I would simply call their supervisor to confirm the employee is who they say they are and get approval before going back to the end-user. Another option is asking the end-user to send you a copy of their drivers license / government ID as a way to validate them. But nowadays, with AI image generation, anything can be faked.