Using `KEY (email, token)` forces a full scan when running the delete action: https://github.com/laravel/framework/blob/master/src/Illuminate/Auth/Reminders/DatabaseReminderRepository.php#L132