Seriously, easier than that only providing the emails in a combo.
The controller asks for a code, but does not check it against a table to verify what password is supposed to be reseted, any user can reset anyones password.
I almost did not believe it.
Go to the complete details ...