BAD assumes:

1. you got login credentials at GOOD

2. you're using the same email address there

They then tell you GOOD will send you a code that you have to enter on their website.

Then they enter your Email on GOOD and request a reset, which sends a mail with a code to you.

You then enter the code on their website.

Now that they have the code they can enter it on GOOD and they have your account.