Take the tour ×  My assumption is that resetting password is
only a security issue if an attacker gained access to the user's
email.  But I was wondering, what if someone simply abuses it
(e.g. sends a "reset password" request every 5 second to an ex
girlfriend/boyfriend email or a hated boss etc)    • Is there a
common practice to have some sort of count / time limit for
password reset requests? (e.g. user can't ask to reset password
more than x times in a period y)    • Or is it considered a non
issue as people don't really do that often? (or at least as
often as people order pizza to someone else's address I assume)
*This is my first question here, I hope it follows the FAQ,
please comment if its not  share|improve this question add
comment  3 Answers  up vote 1 down vote accepted  Yes, it is
very likely that the same "excessive attempts" detection that is
applied to login attempts is also applied to "password reset
requests".  Many systems also involve a captcha step, that makes
spamming the reset attemp