Both values must match the same account. This prevents using one person's email to reset another person's username.