Do you enforce unique email addresses in your system? What would happen if someone has already added my email to their account? What if I click on "Recover password", would I then be able to take over their account by resetting their password?