this function can be spammed, so some kind of protection like captcha is needed to stop this happening