Adding a rate limit to the number of password reset emails in a given day or hour is trivial. SELECT count(*) FROM account_reset_tokens WHERE accountid = ?

Adding a rate limit to the number of password reset emails in a given day or hour is trivial. SELECT count(*) FROM account_reset_tokens WHERE accountid = ? AND (NOW() - created) < '1 hour'::interval if ($count > 3) throw new RateLimitException(); You could also restrict based on IP, but that doesn't specifically help with the botnet. That's what developers can do. What developers should do is consider what prevents their customer support funnel from getting overloaded.