Reset password URL being used twice

[louischan-oursky]

I have a complaint from my project that we should be able to tell the user the URL has been used to reset password so that it is no longer valid.

I know the current implementation derives the code from user information therefore we cannot know the exact cause of why the URL is invalid. It may due to malformed URL or password was reset (i.e. user information changed).

Anyway, I just raise a question here to see if it can be improved.