For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem.
If someone loses access to an email account then I can use manual processes to verify the person and change the email address in the database. This has never happened.
If someone loses access to an email account then I can use manual processes to verify the person and change the email address in the database. This has never happened.
EDIT: "fault" => "problem"