[sickmartian]

I agree that security method a) seems useless, but b) is still good if you take time into account. You know when the account was 'secure' and the forwarding address that was setup can be considered a safe way to recover the password if the user opts in on that (there is surely some use cases for the forward that I'm not thinking about).