The cooldown enforcement on notification recipient verification emails has been hardened to prevent concurrent requests from bypassing the resend window. Rate limiting has also been added to two additional email-sending flows that previously had none.

Thanks to Muhammad Shahzaib for the responsible disclosure that prompted this fix.