Full account takeover of any user through reset password