[bsurmanski]

one idea:

attacker accesses recovery answers for site A. Sees that it is random characters. Attacker has access to site A.

Attacker phones sites B,C,D and E, trys social engineering. Attacker now has access to site B,C,D,E also.