sorry for the late reply. I think probably cause it is out in the open, compared to methods by bigger tech companies like google where the user information is not passed in the url for reset password