Hmm that's correct, but I'd like to add that the risk of a targeted attack is extremely low -- most MTAs nowadays exchange their mails using TLS (transport layer security), so in order to "sniff" this message, you must either be admin on one of the boxes you know the mail will come through, or you must "crack" one.
And, to prevent a random attack when you make legitimate use of a password-reset function, just use the token sent to you as soon as you receive it
