It uses one field, not both. If you want it to use the email address,
do not fill in the username.
On Mon, Feb 23, 2015 at 8:19 AM, Rowe, Dolores A
<dolores.a.rowe(a)boeing.com> wrote:
Shouldn't it be able to use the email address I
have just filled in to send the user a new password, even if
that user had not filled out their email address in their particular profile ?
That would allow you to hijack any account by simply supplying your
own email address to the form.