An attacker could already do this via nearly every service's "forgot my password" functionality, as you noted yourself in the case of hotmail. As the original

An attacker could already do this via nearly every service's "forgot my password" functionality, as you noted yourself in the case of hotmail. As the original author noted, rate limiting is also a fundamental requirement for security. Eventually no more emails are sent because the offending IP addresses are effectively blocked. Make email notifications an option for users (enabled by default, with an easy link in the email to disable), and you ensure your users that your service is secure, while giving them the ability and easy path to ignore it.