It's not from spam emails.

I don't understand how someone had the opportunity to request an SMS Authentication reset in the first place. Just by simple knowing my email had that possibility?