Well, this is an argument for requiring verification if you plan to use email for password resets. Alternatively, you can allow only a small number of password reset attempts per email address per day/hour/whatever. One thing that you shouldn't do is reset someone's password immediately when you send out the reset email. Instead, reset it only when they arrive back at the reset page, else you're opening a DOS attack for anyone whose email address is known.