If emails can be intercepted most password based sites with an email based Forgot Password flow are vulnerable.