I haven't finished reading the article, but isn't the problem here that they are sending the e-mail to the address provided by the user rather than sending it t

I haven't finished reading the article, but isn't the problem here that they are sending the e-mail to the address provided by the user rather than sending it to the e-mail stored in the database ? I fail to see any added value in sending a reset link to an e-mail entered by the user (while that e-mail is already in the database). Is it because the e-mails are stored hashed ?