You identified the threat correctly (legitimate users being prevented from using the app because they forgot or lost access to their password) but the measure y

You identified the threat correctly (legitimate users being prevented from using the app because they forgot or lost access to their password) but the measure you proposed exposes the application to a new threat (attacker can lock accounts without authentication). Now I would typically task you with an exercise to improve your design so that the password reset mechanism, once triggered by an unauthenticated user ("reset password" is clicked) does not result in locking the legitimate account. After a few minutes, you would likely come up with a new protocol that consists in two steps instead of one: 1. Unknown user triggers the password reset mechanism by submitting an email address to the "reset password" form. 2. Legitimate user receives a password reset link by email. If the link is clicked, the legitimate user is redirected to a prompt to provide new credentials. If the link is never clicked, nothing happens. enjoy Then I would challenge you again with a new threat: "Now we have a new problem. Instead of locking user accounts randomly, the attacker could just write a script that submits the password reset form repeatedly for hours, thus triggering thousands of emails and severely disrupting both our users and our email gateways." You would say "oh! that's a great challenge!" :) And a few minutes later, you would likely come up with the solution to implement a CAPTCHA equivalent in the first stage of the password reset mechanism to reduce the likelihood automation. enjoy Then I few months later, I would challenge you again with a new threat: "It appears that someone has devised a technique to bypass our CAPTCHA mechanism. We need to find something else." You would say "oh! that's a great challenge!" :) And a few minutes later, you would likely come up with the epiphany that no, this part of the challenge is actually not that great because we simply reached the final stage of our analysis that basically requires monitoring the world for new research work that would ultimately cancel the benefits of our CAPTCHA mechanism and force us to find something else. But that part of the challenge is for another team ;)