Prng

Password reset tokens came from Apache Commons RandomStringUtils on a seeded java.util.Random, so observed tokens recovered the state and predicted the admin reset token.