I got too.
They could check if the password works before resetting ,they could hash password and be able to compare what it's complicated?