Recovery links are verified before any password can change.