A gaming account recovery flow has one constraint that changes the tooling decision: support needs evidence for every attempted delivery, including a bounced or suppressed recipient, before a short-lived credential expires. TL;DR: keep one active reset token per user and request window, check suppression before each attempt, reuse the same idempotency key on transport retries, and poll delivery events for the audit trail. I would choose a stable capability contract over a vendor-specific mail ...