Implied consent for password reset

Should we remove this check for consent?
https://github.com/csharpfritz/CoreWiki/blob/dev/CoreWiki.Notifications/NotificationService.cs#L89-L92

It not only doesn't stop processing after the consent check fails, but if a user requested a password reset, isn't consent implied?

If it's the case of a malicious user requesting password resets, the end user probably wants to know about that.

Perhaps we should implement rate limiting for reset requests.