Bogus user policy is partially fixed for the forgotten password use case. We will look into further enhancements on to that and the activation module.
If you have not tried the bogus user policy for forgotten password use case in SSPR 4.7, request you to try and let us know your feedback.