Topic: Password reset flood
I think a flood limit on password reset requests would be handy in 1.3 (if it hasn't already been implemented).
I just had some kid thinking it's cool to refresh the page constantly, which resulted in one of my users being badly email bombed by my server.
I added in a limit so you can only reset once a day, I think it would help increase security even more in 1.3.
Sorry if its been suggested, couldn't find it using the search button though.