public function actionSendValidationRequest() This code seems to just allow anyone to make a validation request, no ReCAPTCHA and can totally flood emails causing issues. https://github.com/osCommerce/osCommerce-V4/blob/48d31a361b614cfa66e505d4e8345afd9e30ad79/lib/frontend/controllers/AccountController.php#L2664