How this link is built
It expires after one hour A reset link is a temporary equivalent of the password. The longer it lives, the wider the window in which a compromised mailbox hands over the account.
It works only once The token is marked as consumed as soon as the password actually changes. A link found in a thread six months later opens nothing.
It dies if the password changes The token carries a fingerprint of the current password. Changing the password by any other route mechanically voids every link in circulation, with nothing to enumerate.
The answer is the same for an unknown address Replying "this address does not exist" would let someone test addresses one by one and build a list of our customers. The message shown is therefore deliberately identical.
The change closes other sessions If you are resetting because you suspect unauthorised access, leaving sessions open would empty the measure of its meaning. All of them are revoked the moment the password changes. By creating an account you accept the
terms of service and the
privacy policy . Identity data is kept for the period anti-money-laundering rules require, then deleted.