The threat for phishing attacks grows exponentially. When you redirect users to your webpage, they see a padlock in the URL bar, can check the certificates easily, and get a big red warning screen if the URL gets reported. They also have the option to go the page manually, knowing for sure they're in the right place. In their email client they have none of those. As an attacker I could just as well email a form that asks for their old password in the form in order to get a new one.
