So any email containing an i can be reset. Technically those using a custom domain name are immune but those using a general email service are at risk. Why wo

So any email containing an i can be reset. Technically those using a custom domain name are immune but those using a general email service are at risk. Why would you write a general function that resets an account password but also accept an email address as a parameter? What use-case exists to change the email address sending the message?