I have a user who's been receiving Finish resetting your Salesforce password for days now, every minute on the minute. SF Support say the email received is legitimate from SF but the reset emails are expired/invalid regardless that they've just arrived. I appreciate that all you need to know is the user's username to send such an email from a public page but has anyone had this before? Its clearly scripted likely with malicious intent even though there have been no unauthorized logins.

Audit trail logs don't have anything useful in them. Is there a way to stop this? SF Support are taking their time so I'm looking at alternatives.

  • we generally do not come across this kind of scenario, however getting with SF support is the only way out I can think of
    – Raghu
    Aug 22, 2017 at 20:16

1 Answer 1


If user is still getting emails and we dont want to continue to send, then you can set the Access level of Email Deliverability to 'No Access' for time being, and again change the status of Access Level to All email.(may be this works) Thanks

  • Besides that this is out of the question (this is in production and we're going through dozens of customer cases and so on a day) How would that setting be relevant to the recovery emails? Isn't that for, say, Contact notifications off Cases etc?
    – Usor5000
    Aug 16, 2017 at 12:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .