Wouldn't help much with it right there in the URL too. Even if it weren't, triggering a password reset for somebody and then fuzzing the url space ends up work

Wouldn't help much with it right there in the URL too. Even if it weren't, triggering a password reset for somebody and then fuzzing the url space ends up working pretty quick. I saw a few comments talking about rate limiting but since these are by definition unauthenticated requests, that's not going to help you either. Short version (heh) is you cannot make this secure.