The password reset has an option to use the user name. I don't want to do that, as it's easy for anyone to look at a member name and do a reset. I want the reset to work via email only. Where/how can I set this?
Right.. I want to use the email only. What I don't want is someone to be able to reset a password using only the user name.
As an example.. I know your name is Arty, so I can go to the log-in and reset your password with your user name over and over just to annoy you (or set up a bot to do that to every member of the forum). However, I don't know your email address. So I want the password reset to require the email address - not be done with only the user names. I want the person performing the reset to need to know the users email address to perform a password reset.