It seems to use (src):
$message .= network_site_url( "wp-login.php?action=rp&key=$key&login=" .
rawurlencode( $user_login ), 'login' ) . '&wp_lang=' . $locale . "\r\n\r\n";
but not wp_lostpassword_url(), most likely because of the extra arguments, like key and wp_lang and a different action value.
You could look into the network_site_url filter during the lostpassword_post action, that is fired within the retrieve_password() function.
You might also consider creating a core ticket, to get a valuation if this should be modified in core.
Note that there are better ways than adding php files into the root directory of the WordPress install, like content filters, shortcodes and url rewrites.
In general all PHP modifications should be in a theme/plugin/mu-plugin.