[gloxkiqcza]

Password reset emails usually contain a token that expires rather quickly so unless I’m missing something, this should be a non-issue.

[Fire-Dragon-DoL]

But you can generate such emails with a public username

[SkyPuncher]

Yep. And if you also have access to my email, you can already look at it to figure out exactly what services I have an account with.

If you’ve pawned my email address, you can get my user names, send email reset, etc, etc.

[ipaddr]

Or the email address you have already hacked into. Why both with the username at that point.