prevent attackers from using my password reset mechanism to email bomb people?

[OhadR]

according to https://stackoverflow.com/questions/67290297/how-to-prevent-attackers-from-using-my-password-reset-mechanism-to-email-bomb-pe

My web app has a pretty standard feature that allows a user who forgot their password to reset it by sending themselves a password reset email with a link to the page to create a new password.

I'm concerned that person1 could use this page to harass person2 by claiming to need a password reset email, but giving the email address of person2, and automate this with a bot, sending massive numbers of emails to person2. It wouldn't reveal any secrets, but it could be very annoying, even a DoS on their inbox, and my application would get the blame.