One-click reset. Link expires in 15 minutes. If your email doesn't match an account we'll still say "sent" — that's by design.