Would asking for user input email again in password reset increase security?

Question

I have a workflow like this right now:

1. User inputs the account email and clicks the "forget password" button
2. User receives an email containing a link with token for password reset
3. User clicks on that link, we check for that token from the user's request. If we cannot verify that, we redirect the user away; if we can verify that, we show the user input for changing the password

Would requiring users to input their email again in Step 3 increase security?

Assuming a malicious actor gets control of the gateway of that victim, and has access to the request log and can see the token we put in the URL. If the user clicked on that link, but didn't complete the process to consume that 1-time user token, that actor can then reuse that link for a password reset. Is that a legitimate concern?

Answer 1

If a malicious actor can get the token, then they are likely to be able to get the email, too. Either from the email you send or from your system relating that token to the account.

I see little to no benefit in requiring the user to input their email again when they click the link you send them.