I have a user who's been receiving
Finish resetting your Salesforce password for days now, every minute on the minute. SF Support say the email received is legitimate from SF but the reset emails are expired/invalid regardless that they've just arrived. I appreciate that all you need to know is the user's username to send such an email from a public page but has anyone had this before? Its clearly scripted likely with malicious intent even though there have been no unauthorized logins.
Audit trail logs don't have anything useful in them. Is there a way to stop this? SF Support are taking their time so I'm looking at alternatives.