In other words: a maintenance nightmare, filled with security gotchas, difficult to scale, and hard to write. I'm not sure I follow this. To change a password

In other words: a maintenance nightmare, filled with security gotchas, difficult to scale, and hard to write. I'm not sure I follow this. To change a password you need to write to the db anyways, it's one extra check to set token used=1 or remove it. Why is that a huge deal? Now you don’t have to worry about clearing old bitrot from the database or worrying about when to expire non-verified accounts. It's also possible to use Redis or another fast store with timeouts. The problem seems rather exaggerated.