Why do so many websites - including major social media platforms - allow themselves to be vulnerable to “forgot password” misuse?

I discovered a site called HOLEHE that allows you to run a script to verify whether a particular email address is registered to any user of various popular websites (including Instagram, Snapchat, Twitter, Pinterest, Google, Amazon, eBay, etc.). It does it using those sites’ ‘lost password’ function, and what’s scary is that the target won’t even receive a password reset email. So they have no way of knowing they are being targeted.

Facebook appears to be the only major website …

address amazon called ebay email etc function google instagram lost major media password pinterest platforms popular privacy run scary script snapchat social social media social media platforms target twitter verify vulnerable websites