I was actually able to figure out the duplicate email problem. Having a tenant part of an application, the tenant verification settings do not override the application verification settings. So if verification email was turned on in the application and the tenant, both entities will send out verification emails.
Is this the intended behavior?
The forgot password issue remains.