CoDevs password-reset form didn't have captcha protection or a honeypot field. Someone triggered 400+ requests over three days using an automated script.

Disabled the password reset functionality temporarily.