[1_player]

Also, if the victim has an auto-responder enabled, the attacker will receive an out of office reply, with the password reset link quoted in the email.

[corobo]

I've never seen an autoreply that's included the original message

[matt_morgan]

It was always rare, but it used to be more common than it is now.