> With this type of access, newly minted users were able to get behind the login box API used for content delivery. That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease.

Can anyone make sense of this? In all the "forgot password" functions I've seen, you click "forgot password" and they email you a link to reset the password. How does "Twilio won't send our emails any more" lead to the "forgot password" function allowing account takeovers? I'd have expected it to just make "forgot password" no longer work because nobody can get a reset link any more. I can't figure out how you could configure things for this to lead to a security flaw this bad - other than "write all emails that fail to send somewhere public" which I can't imagine anyone doing. I can't imagine Twilio writing rejected emails from a closed down account somewhere public either. How does Twilio shutting down the account mean password reset links leak?