Man, I've looked everywhere for potential resolutions.
Problem 1: I want to deny users from using "username" to reset password, and ONLY allow email to reset password.
* Can not find an answer, or create the resolution myself.
Problem 2: Do not allow admin to request password reset.
* Can not find an answer, or create the resolution myself.
Problem 3: has been resolved with Captcha and flood control to prevent reset password abuse.
ANY suggestion(s) at this point would be greatly, sincerely appreciated.
Thanks.