I can go to the login page, attempt and fail to login, then click the "email yourself a new password link". Asking the user to confirm the email address used f

I can go to the login page, attempt and fail to login, then click the "email yourself a new password link". Asking the user to confirm the email address used for registration will avoid this problem.