The intention was "any email associated with the user". You submitted an email address, Gitlab looked up the account associated with it, then sent the reset email to the supplied address. The issue was they didn't consider what would happen if you submitted an array of emails.