Currently the "User" and "IP address" fields in security notification emails sent when changing a password using the forgotten password feature are empty.

Jan had already proposed a patch for this in the original security notification issue #21421#note-15, but it seems to have been overlooked. If this was intentionally left out, I am sorry to bother and I suggest adapting the email to not include the fields at all instead of leaving them blank.

I have updated Jans patch against master and I will attach it to this issue.