You're right about some kind of constraint, but what would happen if the user says the SMS never came and needs another? :) Some kind of rate limiting (one per

You're right about some kind of constraint, but what would happen if the user says the SMS never came and needs another? :) Some kind of rate limiting (one per day?) is necessary.