Request a reset below (it just pretends to email a link). The real weakness is /method/own-the-app/reset/confirm: the reset token is a predictable function of the account email - rst_ + md5(email)[:12], no secret, no randomness. Derive the admin's token (you learned its email via the IDOR) and confirm it to be signed in as that account.
Then GET /method/own-the-app/reset/confirm?email=<admin email>&token=<derived>.