There are two separate problems:

1. forgot password does not check whether an account is active before sending out its information
2. new account requests are being marked "active"