Short answer: make the forgot-password endpoint behave the same for a known and unknown address, then let a single-use, short-lived token move the account into a confirmed reset state before revoking sessions. For a marketplace migrating off a managed auth provider, keep that state machine in yo...
Source: [Dev.to](https://dev.to/jasperflint6947/password-recovery-design-anonymous-requests-verified-resets-and-session-revocation-e4m)