Tim, I removed option 2 (show partial email address) for privacy concerns (the partial email can potentially reveal someone's name, for instance). I also removed option 3 because it is not solving the problem, but eliminating it.

I also added an alternative about two-step verification.

What is wrong with eliminating the problem?

It is shortsighted. Imagine we implement this. Then I promise not to forget my password, and ask for password reset to be disabled for me. Late, someone hacks into my account and changes the password. I have no way to take it back.

So you eliminate a problem by introducing other contingencies. That is not strategic.

I would very much like to have this spam reduced. While my username isn't a common name (like Angela), it is _short_ (4 characters). If I had my druthers, I'd prefer the security question as it is least invasive to the user from a day-to-day operational standpoint.

This happened to me today :(. Thanks @revi for https://meta.wikimedia.org/wiki/Community_Wishlist_Survey_2019/Anti-harassment/Add_an_option_to_require_email_address_and_username_to_reset_password. :)

I note when someone is implementing this... under T230436 and by Community-Tech

Logging should be put in place so we can see the state of things (ip/user X requested reset for Y etc)... And we should be putting in a rate limiter to prevent one user/ip doing a loooad of requests

Both should be relatively easy to do while working in the area