Limit password reset requests and reposition feedback message

[Headphaze]

Currently there is the ability to send unlimited password reset requests in a short space of time.
This is a potential point of exploit and should probably be fixed.

I think a reasonable limit would be 5 minutes between activations of this requests.

Also, I think it's worth moving the pop up message to just above the request box so it's easier to see. It can be easily missed at the bottom of the screen on a light-mode interface: "If the address you've entered is correct, you should now receive an email with instructions"

Cheers