This seems extra-terrible for web apps, though. There's a not-uncommon pattern where someone gets an account compromised and starts a password tug-of-war. The

This seems extra-terrible for web apps, though. There's a not-uncommon pattern where someone gets an account compromised and starts a password tug-of-war. The attacker gets entry, and possibly changes the password, but doesn't own the recovery account, so the user finds the problem and uses email reset to change the password again. In this case, it's good to block the old (compromised) password, and bad to set a lockout that gives the attacker more time. Of course, a lot went wrong in that story. Forcing email confirmation of all password resets can help, mandating re-typing of the old password for a change can help (against session hijacking, mostly), and any corporate or user-focused solution should probably have a response scheme for reporting and locking compromised accounts anyway. But for social media style sites where the recovery system is "use your email recovery to fight for control", the reset time does seem like a threat.