A user should not be able to use the same token for forget password and email verification

[xinhuey]

Fix: If an account uses a token for their forget password, they should not be able to use the same token for email verification as well.