At any non-shady dealership, you should presumably have to give some sort of evidence that you own the car in question (registration documents etc. and ID matching the name on the registration). For many online accounts, you probably don't need (or want) to give ID when creating account, so that's out as a way to prove ownership when attempting to recover. So how else do you prove ownership?
I did this recently actually, bought a car where the owner only had a valet key. Had to email them a copy of my registration, my driver's license and the VIN, and they ordered me a new key.
For important accounts I wonder if we should have the ability to tie them to a physical address or something else possible to verify.