So I see the problem now, your model includes a hidden assumption that password resets go to email -- this is not always the case.