I got the same thing.
Email is not confidential though. Anyone who is between snap and the email server could access both the links and the passwords. It should let you upload a PGP key on account creation, and not allow password resets if you don't have one.
I sent bh an email, and this was his response
I think we will be fine
I know. But we just need to identify this hacker who keeps trying to change everyone's passwords.
true. I bet its that spammer.
Not hacker. Spammer.
I think I have some theories as to how this spammer is spamming us.
They took all our accounts' names from the Snap! Forums and entered it into the Snap! website. Then they repeatedly clicked on the "Forgot Password" button to send those emails.
no, really
Probably
There's really no way to do so, unless they rewrite the code to get the IP address of everyone who clicks "forgot password"... but then
A) someone could get wrongly banned
B) it would take too much time
yeah true