Throttle the amount of password recovery emails that can be sent to a single user

Based on Rails Security Checklist

Now it seems like user can request unlimited number of emails with password recovery links/tokens. We need to check it and if it really possible, throttle that number to N per hour/day.