With email verification down, the "reset password" seems to have required no verification other than having the username. So they grabbed an admin account and m

With email verification down, the "reset password" seems to have required no verification other than having the username. So they grabbed an admin account and made scores of new admins. Or I misread something.