Their goal was to send a password reset code to the user's device and have the user tell them the code. Armed with that ...