.@draglikepull I know, it's not really a security hole, but it's still annoying that anyone can trigger that pw request email for you.