"Please create a new password by signing into your account on evernote.com(https://www.evernote.com/Login.action https://www.evernote.com/Login.action). After s

"Please create a new password by signing into your account on evernote.com(https://www.evernote.com/Login.action https://www.evernote.com/Login.action). After signing in, you will be prompted to enter your new password." Why couldn't an attacker do that at this point?