what if a genuine user simply forgets their password or something like that?
Wonderful point
thank you