I guess the problem is that you can just crawl a forum for usernames and then troll a forgot password storm
Maybe we add a mode where you must type the email exactly to get the forgot password, forgot password strict, default off?
I feel like even being trolled once a week is too much, we can not rate limit ourselves out of this one