Wow, that's a lot of questions, and I can't answer all of them without creating security risks!
Our absolute focus is on minimizing the human factors.
In the past year and a bit since that incident, we have improved our escalation policies and support training, as well as let some support staff go.
But more importantly, we now have an automated account recovery system which can be used to verify ownership of the account using a number of different factors (not all of which I'd like to talk about in public - again, if an attacker knows the full algorithm it helps them game it).
Our absolute focus is on minimizing the human factors.
In the past year and a bit since that incident, we have improved our escalation policies and support training, as well as let some support staff go.
But more importantly, we now have an automated account recovery system which can be used to verify ownership of the account using a number of different factors (not all of which I'd like to talk about in public - again, if an attacker knows the full algorithm it helps them game it).