We can rate limit the requests for a particular user in addition to requests from a particular place (a limit which we can see working quite well right now). Maybe give people up to 2 non-expired reset tokens before we say “please just wait for the email”?
6 Likes