Why is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by

Why is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all. Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?