This sounds like something along the lines of password reset poisoning as described in James Kettles' technical write-up "Practical HTTP Host header attacks". [1]

[1]: http://www.skeletonscribe.net/2013/05/practical-http-host-he....