Technically I don’t believe someone needs to know the e-mail for an account to request password reset, just the username.
If the username is public, anyone could type that in forgot password form and an e-mail like this would be sent.
No security risk as long as e-mail inboxes are secure.