[sneak]

> If your email is being "watched" by someone else, then that someone else can access other web services that you own WITHOUT requiring to type passwords!

The person watching your email can ALREADY DO THAT NOW by clicking on the "I forgot my password" link, intercepting the reset email, and then setting a new password and logging in.

[skrebbel]

That assumes someone has live access to your email. If someone has a recent enough dump (or simply a mail you forwarded yourself, because you didn't understand the security implications), then the "forgot password" button does really provide more security than login tokens inside the URL.