Email is just about the least-secure authentication path I can think of. Knowing what we know now, it shouldn't even be used for "forgot password," really. SMS, a phone call, heck even a Facebook message would be more secure.