diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index 5b98ea23..8ce4b64d 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -332,6 +332,11 @@ class UserLostPassHandler extends Handler {
         if (!system.get('smtp.user')) throw new SystemError('Cannot send mail');
         const udoc = await user.getByEmail('system', mail);
         if (!udoc) throw new UserNotFoundError(mail);
+        await Promise.all([
+            this.limitRate('send_mail', 3600, 30, false),
+            this.limitRate(`user_lostpass_${mail}`, 60, 5, false),
+            oplog.log(this, 'user.lostpass', {}),
+        ]);
         const [tid] = await token.add(
             token.TYPE_LOSTPASS,
             system.get('session.unsaved_expire_seconds'),