The the data that would be used to do account recovery is 99% either public record or already part of dozens of prior major data breaches.