Why should we make account activation/password reset links expire after some time?

Question

Would there be any big issues if they never expire?

Somebody forgot his password and requests to reset his password, an email with the password reset link is sent to him.

He then suddenly remembers his password and so he simply ignores the password reset email. But after a few days, he forgot again. Since he already has a password reset email in his mailbox, he simply clicks on that link to go back to the website to reset his password.

This seems ok, so why should we make account activation/password reset links expire after some time?

Answer 1

What if their email account was compromised. The attacker then sees all these "password reset" links and clicks through them further compromising more accounts. Among them your service which may use Real Money or Credit Card information.