Comment by pacifika

The problem is that your password reset token shouldn't be reusable. The token is only leaked after the person visited the reset page, which should invalidate the token on load.

Without a valid token, the reset form shouldn't load. Problem solved.