Forgotten password
We send a reset link to your account e-mail address. The link is valid for one hour and can be used only once.
What happens here
The link expires
It stops working after one hour. The deadline is set when the link is issued, not when you open it.
Single use
It lapses after the first use, and so do any earlier links you requested.
We do not tell
The answer is the same for an existing and a non-existing address. Not only the wording: the length and the timing too.
The old password
Until someone opens the link, your password stays unchanged. An unsolicited mail by itself changes nothing.
Mail delivery
The sending domain is not registered yet, so on a development install the mail goes to the local sink, not to a real address.