Custom login URL & password reset

I have Custom login URL set to /sign-in. The lost password form is then at /sign-in/?action=lostpassword. When you submit the lost password form the password reset email is sent successfully, but you’re redirected to /sign-in/wp-login.php?checkemail=confirm which displays the message “We’re sorry, you are not allowed to proceed. Your request looks suspiciously similar to automated requests from spam posting software or it has been denied by a security policy configured by the website administrator.”. Any ideas on how this can be fixed? Thanks!