Comment by B-Con

The entire "account recovery" concept just reeks of ad-hoc solutions piled on top of ad-hoc solutions. They're designed primarily so that legit customers who can't get into their accounts suffer as little inconvenience as possible, and they try to toss some security in on the side.