@chiraag once the registrar is confident they are talking to their client, they supply a token which is then given to the new registrar. The pw reset obviously can't rely on me having login creds, so if they trust my email address for that then it'd be no different than simply emailing the transfer token to the email address on file.