The reset token is a predictable function of the email — rst_ + md5(email)[:12], no secret, no randomness. Forge the token for root@ratauth.io and confirm it to take the account over.
Then visit /reset/confirm?email=root@ratauth.io&token=<forged>.