[hombre_fatal]

Your link doesn't apply here. The attacker's recovery process is to just send an email to [e-mail] and start flapping their gums.

It doesn't matter if you lose data. If you control an email address, you get all future email including forgot-my-password emails.