Password email was sent without requesting it

[Liliana M]

Hi Guys, 

 

 

The recovery password (forgot your password) module is having a weird behavior, an extra recovery password email (the email with the password on it) was sent to me one day after I requested a new password.

 

In other words I got 2 emails, the 1st one on the day I requested my new password but the 2nd one a day after with a different password  I did not request the 2nd one.

 

I'm very worry about that, what's more, I have a customer that told me that she did not request a new password however an email with the password on it was sent to her  

 

I would appreciate any help, thank you very much in advanced. 

 

I'm using PS 1.6.0.11

 

Liliana

 

 

 

 

 

 

 

 

[bellini13]

It may not have been you or your customer that made the request...

[Liliana M]

Hi bellini13,

 

This is not the case, because when you request a new password, an email with a link is sent to you, then you click on the link and it is when the system automatically generates a new password and send it to you.

 

 

My case is that second email (the one that contains the password) was sent suddenly  

 

 

 

Liliana

[bellini13]

I understand how it works, however my reply doesn't really change.  It still does not have to be you or the customer that initiated it, or clicked that link more than once. 

 

1 of 2 things is happening here

1) Someone is clicking the link in that email more than once

2) Your mail server did not think the first email was sent successfully, so it resent it

 

I would suggest reviewing your access log and you can easily figure out if it is #1 that is occuring, but seeing who has requested the URL and when (ip address and date/time)