This question already has an answer here:
Let's assume this situation: I am a user of an online shop, I forgot my password. So I use the functionality of this online shop to reset my password. The online shop sends me an email with a link I should visit to change my password. I changed my password, but did not delete this email.
Now, a day later (after this passwod reset) I saw this email again and clicked again on it and I can change my password again. From a security perspective: How would you value this situation?