[firebones]

How about two-provider authentication? (2PA?) Send codes/links to two confirmed but independent accounts (email + Twitter, or Facebook + SMS) and require those to be entered.

Probably not anymore secure--and a nightmare to manage. But look to consensus algorithms for authentication ideas.

[AstralStorm]

Phone is a (slightly) harder target, but Twitter + email is equivalent to just email.