only send forgotten password emails to the affected account, not the admin email - there is a BCC in place now for us to get a copy anyway