### Email Functionality Key Check Items

Look for missing validations and content filtering:

- **Missing rate limiting**: Check for missing frequency or daily limit control logic before sending emails (leading to email bombing).
- **User-controllable email content**: When constructing email content or reset links, review the risk of directly concatenating frontend-passed parameters (such as URLs, Host, custom text) into the email template without whitelist validation (leading to phishing content injection).
