Or the attacker might request a new password for a user, forcing them to access their email account to regain access.
If the system locks any resources for a single user, then an attacker could potentially tie them up so others could not use them.