Never would have occurred to me that this could be used to intercept password reset emails. Very scary.
Many services state in the password reset emails that "if this was not initiated by you, ignore it", but it really should be the exact opposite - click the link below to report it!