Login tokens solves the re-use (but does put the onus on their email being secure).