If you're allowing emails as a credential reset mechanism, you've already got that problem.