Concrete CMS (previously concrete5) prior to 9.1 did not have a rate limit for password resets.
concretecms concrete cms