[BHSPitMonkey]

If it were a malicious backdoor, it wouldn't have been "hidden" in the response to the _actual_ password reset request form.