A user submitting an account recovery request can put arbitrary text into the "description" field, which they could use to forge additional fields below the description and attempt to trick the person reading the ticket.

We should delimit the description field in the ticket body, putting it in between a banner, something like this:

=== Begin user-supplied description (untrusted) ===
{description}
=== End user-supplied description ===

(This task is based on a security review of Special:AccountRecovery that @kostajh did using Claude Code.)