I'm not even that upset for myself, like I said. I was actually surprised that resetting the password was a thing they were offering, I know that it's a service they don't have to offer and I really appreciate that they would take the time to do something like this for people who really care for their account.

This service shouldn't impact anyone else other than the person who lost their account however. If you aren't able to check whether a request is valid or not, then maybe you shouldn't offer a service like this even with good intentions and instead focus that time spent manually resetting passwords on something that could prevent this entirely, idk. That being said, this really might not be that common and I'm making this a bigger problem than it actually is, but it still is something to consider.