Should have needed. I recommend listening to (or reading the transcript of) https://darknetdiaries.com/transcript/118/ about someone doing account hijacking/password reset as a service. Even good services sometimes have zero-days.