One of my friends has forgotten his Apple ID password and is attempting to reset it. I told him to go to Apple's password reset page, which he has done. He opted for email authentication/reset since he's also forgotten his security question/answer.
When he does this, he receives this email.
The password for your Apple ID
firstname.lastname@example.org been successfully reset.
If you believe you have received this email in error, or that an unauthorized person has accessed your account, please go to iforgot.apple.com to reset your password immediately. Then review and update your security settings at appleid.apple.com >
Questions? There are lots of answers on our Apple ID support page >
Thanks, Apple Customer Support
At no point was he prompted to enter a new password, so I don't see how it can have been successfully reset (and to what?). Going back to iforgot.apple.com results in the same email.
I've tried resetting my own password, and I receive an email that takes me a form to enter a new password, after which I then receive the email above - so it works perfectly. What is going on?
I've just noticed that more than one email address can be associated with an Apple account. Is it possible that the email I received that took me to the password reset form is being sent to a secondary email (he doesn't know whether he set any up)? If that's the case, surely that must mean that somebody is reading his old email account and processing the reset request for him to receive the confirmation to his primary email address? All this seems a little odd.