Bonus-rage if the exploitable "recovery" path relies on "Security Questions" you cannot change which are not-really-very-secret and which overlap with the same questions recorded (and leaked) by other companies.