Per
https://github.com/discourse/discourse/commit/d8d54a92f15782bb906d2f0b2c7d5e966b29f819
I tightened the rules so worst case scenario a user can only get 6 resets a day. That should limit the emails to a degree.
I also followed @riking’s advice here and we respect screened emails, so if you block an IP as an admin that IP can not participate in this party anymore.
One big omission here @riking which can assist self medication a bit is that the “password reset” email does not include the IP address of the person that initiated it:
@codinghorror how do you feel about adding the IP address of the initiator in the set password emails (we could even hide it a bit), it will allow much better self medication.
Jane gets attacked
Jane notifies site admin that 12.12.12.12 keeps resetting passwords
Admin blocks 12.12.12.12
People do have access to lots of IPs so this can still be cat and mouse, but at least it is better than it was and the limits are tighter.
Facebook use this trick, which I kind of support implementing:
It allows them to avoid including IP addresses in the Email, they just track it server side and the link contains an id in the database. So this means it can become a 1 click kind of operation to block an abuser.
For context facebook require email for password reset (they don’t even have password reset in a traditional sense, it is simply login via email)