My Instagram password is unique and it got a reset request, so it’s unlikely that a password somewhere else was leaked and they tried it against Instagram first and successfully might I add, I reset my password manually and I had to be logged in first and know the original password.
To be clear, you have described setting your password.
The scenario that happened this week was the “not logged in, forgotten my password” - which for obvious reasons doesn’t require either of those things - just an email (or sometimes, username).
My Instagram password is unique and it got a reset request, so it’s unlikely that a password somewhere else was leaked and they tried it against Instagram first and successfully might I add, I reset my password manually and I had to be logged in first and know the original password.
To be clear, you have described setting your password.
The scenario that happened this week was the “not logged in, forgotten my password” - which for obvious reasons doesn’t require either of those things - just an email (or sometimes, username).
Would the email still use the reset term? That’s what it says. I don’t use the account but I don’t want anyone else using it either.
Check out https://www.instagram.com/accounts/password/reset/
You can see that it uses the word “reset” in both the URL and the page, and only requires an email address to trigger.