I think this problem can also be mitigated by the additional parameters in the reset link like the expration time. If these parametes differ you actually dont g

I think this problem can also be mitigated by the additional parameters in the reset link like the expration time. If these parametes differ you actually dont get to hash one thing and test it against all currently valid reset URLs to make brute force easier. You could even salt your reset URL deliberately. Of corse, I'm not arguing against rate limiting.