It’s definitely annoying if someone decides to trigger the “forgot password” over and over on your behalf .. but we can’t lock the user out of password resets based on this, because locking someone out of password resets is also a form of griefing. 
I believe we have a rate limit here on the order of multiple times per minute, can you review this code path @riking and confirm that’s still functioning? We could increase it but that can’t safely cover “a few times a day”.
Also, banning an IP address via Admin, Logs, Screened IPs should prevent that IP address from issuing a password reset, I think, and we should also verify that’s working as expected @riking.