One of these users doesn't own the email address they have input. If it's the first one, I'm not sure how they could trigger a password reset without access, if its the second one, then I'm not sure why it's surprising you can have your account reset when you signup with someone elses email.