Blackbaud customer support told me:  It is expected behavior for someone to receive a password reset email if they make more than one donation but have never logged in to the website. This is a confusing and alarming thing for Luminate to do, and I have received multiple emails from constitutents who were worried about the security of donation! This should not be default behavior in Luminate.