Your password-reset form is a free email cannon

An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their reset form into a spam cannon, billed to your sender reputation. The fix, without leaking which emails have accounts.