The entire process is bad, doing the measures you described would have helped, but it's still negligent to allow AI to do password resets to arbitrary emails without auth, even if the account is of low value.
The entire process is bad, doing the measures you described would have helped, but it's still negligent to allow AI to do password resets to arbitrary emails without auth, even if the account is of low value.