I think part of the issue is that our email address has largely become our identity, much like our phone number has. If someone gets into your email, they can effectively take over your whole life. This has caused the security around it to go up, but ironically, this leads to more account lockouts, which then locks the user out of a lot of their life with no way to recover.

It's a bad system all the way around. I've been debating a few moves and I've been kicking the can down the road, because I'm worried about some of these sharp edges.