Since MetaMask doesn't have a "Forgot Password" email link, you have to follow these steps to regain access:

Don't use birthdays or common words; crypto-draining malware specifically targets weak local security.