Wave of X password reset emails could be hiding a sneak phishing attack

X users are receiving password reset confirmation emails apparently triggered by hackers, which may be hiding a second attack.