This is a nonsensical argument; do a forgot password reset via email on any website and you will get what is, in essence, a clickable unguessable random GUID. If you forward that email with the clickable GUID or it is intercepted by an attacker… you are gonna have a bad time.
The only thing that can protect you is two factor auth.