That solution is like putting glitter on poop. The entire process is bad, doing the measures you described would have helped, but it's still negligent to allow

That solution is like putting glitter on poop. The entire process is bad, doing the measures you described would have helped, but it's still negligent to allow AI to do password resets to arbitrary emails without auth, even if the account is of low value.