Often we deal with users email addresses getting placed on Box's internal block list. Then a user might request a new password, but the email will never come in. In that scenario, if a user has requested a password reset email, you should check your block list for that user's email address and remove it if necessary.