2017-12-12, 08:30 PM
For Forums using Social login which allows a user login without an email address, bots can keep triggering the password reset just by clicking the submit button (blank email address) and everyone who's logged in via social login (without an email address) will get a password reset email