Most of the typical things we turn to for security questions _could_ be easily figured out if you were the target in an attack.

I guess what I believe should happen is #3, always. This second person is more likely to spot when something is awry with the request.