[kayman]

It’s because the average person has so many passwords in various formats that they forget. But that person most likely has access to their email. Instead of taking the user on a password reset journey, just shortcut to login. The attack vector is restricted to email no matter what.

[fred_is_fred]

I suspected that was the case, but I really wish they'd give me an option.