From reading the code it looks like entries to borrower_password_recovery are only cleaned up when an expired verification link is clicked or a password is reset successfully. It would be nice to have an option in cleanup_database to regularly clean up the table by deleting requests expired more than x days.