Lot's of services realized that users would use the reset password form for login.
To state the obvious, there the code is part of the url they have to visit.