We're using Jira Service Desk 4.0.2 and sometimes our customers even forget their login name. We're telling our customers to visit https://oursite.com/servicedesk/customer/portal/1/user/forgotpassword in order to reset their password. But the form accepts an empty username / email and shows an "An Email has been sent to" confirmation screen to the user afterwards. Obviously no email was sent, since there was no email supplied.
