That's true but with reset password links you can force the user to do extra work, like enter a CAPTCHA or answer a secret question. That should prevent bots from scraping and compromising accounts on a large scale.