Reply to thread

It is not impossible. Think about what happens if the address is already confirmed. Take your account on this site, for example; I assume it is confirmed. If I know your email address, I can go to xf.com/login, click Forgot Password, and type your email address. You will get the reset email, even though I filled it out. I can keep filling it out, and you will keep getting emails and not understand why. Just because there is a captcha, does not stop me as a human, and there are known bot softwares out there (I won't name them here but I had to ban some users on my XF site who were using them) that can bypass most of the captcha settings in XenForo.