In my system, a new user must confirm his email.
But there is an edge case:
- he registers
- does not confirm
- forgets password, performs password reset (which involves a mail loop)
At that point I know his email works - so I'm inclined to reset his password, and then simply mark his email as "confirmed".
Are there any risks I've not considered?