Domains are not case sensitive, but email local parts are! There is no reason whatsoever to do case normalization on local parts of emails on any domain you do

Domains are not case sensitive, but email local parts are! There is no reason whatsoever to do case normalization on local parts of emails on any domain you do not own, as this is strictly incorrect and could lead to a totally different address that also exists (as happened here). Of course, email providers are free to do whatever case folding or normalization they want, in which case the security burden of avoiding collisions is on the provider. If someone's email provider maps different case variants to the same mailbox, there's still no need whatsoever to do anything to the address, as the user will get it delivered to them regardless. If the provider doesn't do case folding, they will have to enter their local part case sensitively, but that's exactly the same as for any other use of their email address. I can only imagine how this vulnerability came to be. Unicode is not to blame here. If security-critical password reset code was not audited carefully enough to catch a mistake like this, one wonders what other errors might remain.