The logic here is that it doesn't reduce security by much, but it significantly reduces password resets. Facebook does it too (and more) which we talked about two months ago: https://news.ycombinator.com/item?id=13426544 . Some good points were brought up.