Thank you @verek and @cmw14,

I've checked and the escaping of username doesn't affect the reset password process.

In any case we just updated wpForo core in wordpress.org plugin directory without new version release. You can deactivate, delete wpForo, search and install it again to have escaped usernames in reset password URL.

That fixed it. Thanks Robert.