Description of problem: Disabled accounts should not be able to have passwords changed. token.cgi needs to check for account disabled and not send the email.
Red Hat Bugzilla is now using version 3.2 of the Bugzilla codebase and therefore this bug will need to be re-verified against the new release. With the updated code this bug may no longer be relevant or may have been fixed in the new code. Updating bug version to 3.2.