Without a code, there is a pretty high risk of an attacker social engineering an account holder into sending an email.

I haven't really thought this through (what an attacker would gain), just want to point out the general risk.