We're using Jira Service Desk 4.0.2 and sometimes our customers even forget their login name. We're telling our customers to visit https://oursite.com/servicedesk/customer/portal/1/user/forgotpassword in order to reset their password. But the form accepts an empty username / email and shows an "An Email has been sent to" confirmation screen to the user afterwards. Obviously no email was sent, since there was no email supplied.
Community moderators have prevented the ability to post new answers.