Why does not Google Password Reset include the originator IP address?
Today somebody tried to retrieve a password from my Google Apps domain admin account and apparently same person tried doing the same for domain of my colleague.
Stuff like that is expected to happen from time to time of course, when your website is a potential target for attacks, but what surprised me was the fact, there was no any information on Google Password Reset email (which naturally arrived to my inbox) about the requester. So, I have no other means of tracking potential attacker, but to seat and wait for next attempts.
Granted, IP address could be spoofed, but is there any reason why Google would not want to include this in the notification email?..