Nopcommerce 4.1 or higher.
Method: MessageTokenProvider.cs → RouteUrl
This method is used to generate an absolute Url using some parameters.
If any of those parameters has "+" (I found this with this character but probably it is not the only one) then the Url is not encoded correctly.
RouteUrl is using -> Uri.EscapeUriString and this function doesn't change the "+" symbol. In nop4.0 "+" was changed by "%20"
How to reproduce this:
The recovery password functionality will not work for customers with a "+" in the email address.