Website allows people to spam emails to anyone

[SaucysMayhem]

trafficstars

Hello there, I have recently been SPAMMED with emails because you can send a password recovery email to anyone's email just by entering their PNID, I feel like this should 100% change

[jonbarrow]

This is how all username based account systems with a password reset work. It's not unique to this. Also it's impossible to remove PNIDs as input given that emails are not unique to specific users. Nintendo Network was designed to allow an email address to be reused by any number of accounts, and because of this so do we. Without using a PNID as input it's not possible to reliably pull the users email address.

[DanilochTop]

I was reading this issue and perhaps the possibility of adding a rate limit for sending emails based on the user's PNID could be taken into consideration. Also, a captcha could be added which would be more effective and avoid users from blocking other users requests. This, in addition to preventing spam, would avoid excessive spending on email APIs.

[jonbarrow]

Sure, but that's a different issue than the one described here.