How can I limit the password reset attempts?
You can use the Flood Control module for it.

Flood Control provides an administration interface for hidden flood
control variables, like the login attempt limiters and any future
hidden variables.