Should have needed. I recommend listening to (or reading the transcript of) https://darknetdiaries.com/transcript/118/ about someone doing account hijacking/password reset as a service. Even good services sometimes have zero-days.

Microsoft supports self-service password reset: https://learn.microsoft.com/en-us/entra/identity/authenticat...

"Microsoft Entra self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement. If Microsoft Entra ID locks a user's account or they forget their password, they can follow prompts to unblock themselves and get back to work."

Which isn't actually quite as crazy as it sounds like it should be.

No? If you're resetting your email password, it's probably because you're locked out of your email and thus the reset process shouldn't require email.