Without a code, there is a pretty high risk of an attacker social engineering an account holder into sending an email.
I haven't really thought this through (what an attacker would gain), just want to point out the general risk.
I haven't really thought this through (what an attacker would gain), just want to point out the general risk.
Do you want to put the code into the recipient email address?