A parser disagreement between SMTP servers and MySQL casts puny-coded characters back to ASCII — turning a forgot-password flow into a 0-click account takeover.