title: How to protect a reset password feature?
body: <p>I want to implement a reset password feature in case users lose their passwords. But I'm worried about someone being able to make a lot of these requests for a single or multiple email addresses that don't belong to him, which would be annoying for the actual owners of those addresses, and I would end up blacklisted.</p>
  
  <p>What can I do to secure this feature against that? Set a limit of valid emails sent per ip? (3 emails max would be fine I guess)</p>