With email based password recovery, the user can enter either a username or an email, and it will mail a link to reset that users password.

If both are entered however, it will send a link to reset the user to the email entered, even if the email doesn't match the user's.  This allows you to reset the password for any user.

Attaching a patch for 7.4.

Fixed in 7.5.26, 7.6.1.