I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server and MembershipReboot).
A substantial number of existing users have non-unique or null email addresses. These will all be seeded from the existing app to MembershipReboot's database.
The forgotten password process (using a username field to generate and send an OTP via SMS) is being replaced with MembershipReboot's forgotten credential process using email addresses to generate a URL for users to reset their password.
For those users with a shared email address should I include a separate step to capture the username after capturing the users email address to generate a URL for the correct user? Or is there a reasonable alternative that doesn't require any proactive user change?