Why is password reset considered a big issue? If I know your email / login I can go reset your password for a bunch of stuff now without any breach.