Who cares if people can do mass recovery though, since they can't access your e-mail it doesn't do anything?  That's why all those e-mails just say if you didn't request to reset your password just delete the e-mail.  Not exactly a big security flaw.