Where are valid password reset tokens stored?
I do not think Drupal stores password tokens. I have used drush uli many times and it generates a one time login link, similar to link generated by user_pass_reset_url(). You should see the functions coding