password reset token security bug

When a user request for password reset more than once within the validity period, all the token is valid, so if any other people managed to get hold of the unused token before it expires, he/she can simply change new password.