otp

How inconsistent email normalization between the rate limiter and delivery logic allows unlimited OTP requests — a classic normalization-mismatch bug.