Am I missing something? The source they shared is a screenshot of a password reset email, which anyone can trigger if they have the email address of the account.
I have a masked email* for Instagram and have received two password reset requests in the last five days. Obviously, this is just an anecdote.
You don't even need the email address. The account name is enough to start the password request.