Password reset tokens now auto-expire when new reset requests are made.

src/schemas/user/passwordResetSchema.js

@@ -72,6 +72,12 @@ passwordResetSchema.pre('save', async function (next){
         this.ipHash = hashUtil.hashIP(this.ipHash);
     }
 
+    //If the user was modified (usually only on document initialization)
+    if(this.isModified('user')){
+        //Delete previous requests for the given user
+        const requests = await this.model().deleteMany({user: this.user._id});
+    }
+
     next();
 });