Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html It mentioned that password reset link should be single use and expire after appropriate period. I don't understand why should it be single use? I'm new in this section of SE (and to security in general), so if mod thinks there are better tags, feel free to change it.