Use case is to prevent any dictionary attack on forget password flow, where attacker can trigger any no. of emails using forget password flow.
A user selecting the 'Forgot Password' button should only be able to enter a valid user email address and be required to then only interact with the system to reset the password via the link provided in an email to that address.
Furthermore, the link provided needs to have a time-out value assigned to it so it is only valid for perhaps 30min at the most. If an attacker already has compromised a valid users email that is used to login there isn't a lot that could be done and that person would not need to brute-force the login.
But, to stop brute-force logins just put in a limit of failed attempts before the IP address is no longer permitted to attempt a login