An issue exists in Enalean Tuleap prior to 10.5. Reset password links are not invalidated after a user changes its password.
enalean tuleap