Your password-reset form is a free email cannon — Authagonal

The password-reset form is probably the least interesting endpoint you own. It is also the only one an attacker can point at anyone. Ours…