# Forgot\_password abuse

**URL:** <https://meta.discourse.org/t/forgot-password-abuse/150668>\
**Category:** Feature\
**Created:** [May 7, 2020, 12:51am UTC](https://meta.discourse.org/t/forgot-password-abuse/150668 "2020-05-07T00:51:56Z")\
**Posts on this page:** 1\
**Showing post:** 16

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [May 7, 2020, 10:35am UTC](https://meta.discourse.org/t/forgot-password-abuse/150668/16 "2020-05-07T10:35:11Z")

</div>

I guess the problem is that you can just crawl a forum for usernames and then troll a forgot password storm

Maybe we add a mode where you must type the email exactly to get the forgot password, forgot password strict, default off?

I feel like even being trolled once a week is too much, we can not rate limit ourselves out of this one

---

_[View the full topic](https://meta.discourse.org/t/forgot-password-abuse/150668)._