It's not particularly worrisome as shown in the screenshot. It appears the attacker could only send a password reset link or temporary password to the e-mail ad

It's not particularly worrisome as shown in the screenshot. It appears the attacker could only send a password reset link or temporary password to the e-mail address of the user account. There is nothing in the screenshot indicating that the attacker could have changed the e-mail address to one controlled by the attacker, thus being able to reset the user's account.