Problem Definition

When Confluence is configured with a mail server, Confluence users are able to request for a Password Reset email from the login page by entering a valid username or email address after clicking on the "Forgot your password?" link.

However, there is no spam control to this action as the user can click the "Send it to me" button multiple times without any cooldown or verification which in a way can cause a burden to either Confluence or the mail server.

Suggested Solution

Implementation of spam control such as CAPTCHA when a continuous attempt to request the password reset email is detected.