I feel like you have two choices for password reset flows: 1. Insecure ones 2. Ones where many users needing recovery will get locked out with no ability to r

I feel like you have two choices for password reset flows: 1. Insecure ones 2. Ones where many users needing recovery will get locked out with no ability to recover their accounts, guaranteed