You shouldn't be forced to discover what capabilities exist by brute force. Just freaking explain it.

But since there's a potential nonzero risk of permanent account loss, I don't want to experiment, and since I can still log in with email/password I'm going to keep doing that.