Question: I don't know how to write this without it sounding like a plug (lol), but it's not. So please don't close-vote it, even if you really want your editor badge. Here goes:

There's this site called av-comparatives that I use and trust to provide me independent antivirus reviews. You probably do, too, actually. While I keep myself somewhat knowledgeable about infosec, my specialties lay elsewhere and it's so useful for me to have something like that as a resource.

I don't know of anything like that for firewalls, and when I go out to find one, I'm accosted with millions, all claiming that one product or another is the best. Cross-referencing them often leads to one or two that I've never heard of. The (I think) fairly obvious conclusion there is that these are all just fake third party review sites set up for marketing purposes.

Unfortunately, I don't have the resilience to wade through such murky waters for so many more hours :P

> 
> IMPORTANT: This is **NOT** an open invitation to fake firewall review sites to post
>  their crap. I will respond appropriately to spam. 
> 
> 
> 

I'm looking for legit review sites that you, as security professionals, trust (ie: on par with av-comparatives, which you probably trust too)

Answer: 
Possibly. It's not immediately clear if you are relying on the email address as the sole identifier (i.e. you're using it as the username) or if a separate username is in play. If the latter case, then the obvious flaw is that an attacker can supply the username of someone else, but provide their own email address as the destination for the recovery password.

Assuming the email address is the only identifier for a user, obviously it will need to be supplied by them in order to reset their password. I would suggest that regardless of whether an account associated with that email address actually exists, the system should respond similarly. (E.g. saying "Your password recovery information has been sent.") However, you would obviously only want to send the recovery email if there is a corresponding account; if no such account exists there is nothing to recover. This prevents an attacker from trying multiple addresses to see which succeed and which fail, and thus building a list of valid accounts on the system. (If your application is faster to respond if it doesn't need to send the email, you may wish to intentionally add a random bit of time delay to hide that.)
Phishing
--------

Spammers could spoof your password reset email and trick other users to click on a link that phish for information

Attackers could DDOS your server
--------------------------------

By submitting the form rapidly, your server might not be able to keep up with the processing power required for sending out emails fast enough