Sorry you're missing the point - its not the security aspect of it my 'friend' is concerned about. Its the hastle of getting endless messages that someone is has tried to reset the password.

There is no questions that someone won't succeed becuase the system e-mails the link with password reset tolken.

Changing e-mail address will do nothing as if he was to use it in his BAEC account it would just send the password reset email to the new e-mail.