After some testing I see that /wp-login.php?action=lostpassword is available. But when I click Forgot Password on /wp-admin/ it redirects me to /lost-password/ which is blocked. This probably happens because woocomerce is changing the url to a “pretty” url.