PanicInParadise just gave me some info regarding password resets from 2013 still being active. He had a password reset for the account SkySpell from 7/17/2013, and he was still able to click it to reset the password:
After selecting a new password, the password reset was successful as well:
You should probably expire password resets from that long ago.
But please don’t expire them quickly, if I loan my acc to someone, for convenience sake, I use a password reset to take it back, and I wouldn’t want something to go wrong and it to have expired because ‘Lol, if you don’t click in a day, this must mean you didn’t want it reset’