Password reset by email link

Design the forgot-password flow for a consumer web app with 3 million accounts that sign in with an email and a password. A user enters their email, receives a link, and sets a new password. About 15,000 resets are requested a day, and attackers also use the form to find out which emails have accounts and to flood people's inboxes. The link must work once, expire after 30 minutes, and be useless to anyone who can read the database. After a reset, every other device signed in to the account should be signed out. Describe what is stored, the API, and the safeguards.