That would imply they have to test that the credentials are correct though.

Otherwise I can just put somebody’s user and put some fake password and they would reset it and disconnect the account of that user and annoy him.