From RFC 4226 I understand how HOTP generates one-time passwords by incrementing a counter and uses the 'look-ahead' window to try to resynchronise (from this counter), if the user tries a few wrong passwords.
Say the user leaves their token with their cat, which decides to generate 200 passwords while rolling around with it. This would likely desynchronise the system such that the user will not be able to login in, even with the look-ahead.
I assume the user would need assistance to reset the system, but what are the actual steps to doing this?
Additionally, what would be a good number for the parameter w? 10? 50? 100?