Router::connect('/resetpassword', ...)
means, that you are not using anything after it as passed params etc. But you do that, so correct is:
Router::connect('/resetpassword/*', ...)
Also note that
Router::url( array('controller'=>'users','action'=>'resetpassword'), true ).'/'.$key.'#'.$hash;
is wrong, it should be - as documented:
Router::url(
array(
'controller' => 'users',
'action' => 'resetpassword',
$key, // passed param
'#' => $hash // hash
), true);