Multiple users are reporting their 'forgot password' / password reset function is being triggered, and that they're receiving emails with the verification code etc, even though they didn't request a password reset.
The forgot password / password reset form requires an email address input so I can't imagine how spam bots would be able to submit that form (without knowing users email address). So I am baffled.
How to prevent this from happening?