Where are valid password reset tokens stored? When one submits the form on user/password or executes drush uli, a password token is generated. Where does Drupal store these?
I do not think Drupal stores password tokens. I have used drush uli many times and it generates a one time login link, similar to link generated by user_pass_reset_url(). You should see the functions coding