Just because Facebook does it doesn't mean its standard. If we provide the ability to give feedback to this level it should be off by default. This feature should be disabled until such time as the developer has properly considered its implications and dealt with the security issue in their application. Rate limiting is out of scope of this bundles feature set.

I'm even of the opinion that we shouldnt be providing this feature to anonymous users. You should be required to login first. A password reset email should also be considered email verification once it is successful which means there is no reason to even provide a link to this controller unless the user is logged in and hasnt yet confirmed their account.