@cshirky presumably no 2fa on email? That's my number one rec. Always, always, *ALWAYS* have 2fa on your email. It is the skeleton key for all forgot password requests.