Comment by spike021

What if they have access to some users' emails and then can selectively fire off password reset emails to them? It's probably less likely, but could be a vector.