Thank you so much for this blog post! It explains why resetting people's passwords in our sandbox became a major task. Resets now look like logging in as them, changing the email to one I control, accepting the email change, resetting their password, and giving them the password so that they can log in and change their email address. Otherwise, with the .invald at the end of their username, there's no way to get them in if they've forgotten their password.