No rate limiting on resend verification mail. about audit HOT 1 OPEN

threatLevel="Low" type="Insufficient Abuse Mitigation">

There is no limit on the number of forms a user can submit by (ab)using the "Resend Verification E-mail" functionality. Due to this it was possible to send 60 mails in two minutes.

impact:
Lack of rate limits allows attackers / spammers to take advantage of the
web / mail server capacity using automated tools. This is exacerbated by
the fact that attackers can add their own files (see also
Anonymous file upload). This in turn could also lead to
the mail infrastructure that Red Cross uses will be flagged as
malicious, and could be banned by spam filters.

recommendation:
Implement reasonable rate limits on the server side, where a unique IP
address can only subscribe a reasonable number of times in a set
time frame.
Do not allow cookies or other parameters to be replayed, but require a
unique 'token' per form submission.

from audit.