Agreed, but only if that account recovery mechanism absolutely can't be used to steal people's identity. It has to be thoroughly investigated for all sorts of scenarios.