I just assumed someone was going through a database of known FB accounts and triggering the reset looking for people who accept.
It is strange that they appear to be able to avoid being blocked for bulk/frequent requests though. Seems like a big flaw.