sequence:
- hacker originally reports the IG account, either via web or email; unclear
- fb writes to the CORRECT email account and says "reply from textsfromyourex@gmail.com" to verify identity, and quote original email.
- the original email is easy to quote because it is a formulaic form letter that anyone can know.
- hacker writes a spoof email appearing to come FROM textsfromyourex@gmail.com which includes the formulaic copy-paste. hacker performs two attempts.
- the first attempt includes yourtextsfromyourex@gmail.com [fake] in the quoted message body.
- the second attempt includes textsfromyourex@gmail.com [correct] in the quoted message body.
- THEORY: fb broadcasts the reset link to both textsfromyourex@gmail.com [correct] and yourtextsfromyourex@gmail.com [fake]?
-hacker owns the fake account
-hacker gets reset link

questions:
- does something parse the quoted content?
- do pw reset links get broadcasted to original AND "verified" (via spoof) new addresses?