nice but how did the actual password reset work?

according to you if u set your firstname or lastname as a the attacker's site like http://evil.com you get the reset link like http://evil.com?token=xxx

so if you use your actual name like mayank

you will get the reset link like

mayank?token=xxx

which does not make any sense