It doesn't say how they are sending it to an unauthorized email, maybe their is some hidden value in the form that they are sending to allow it or something altogether different to get the reset email.

Just because you can't do it doesn't mean it is fixed.