[Nilzor]

That wouldn't really helped you in this case, would it? The attacker got the account reset simply by phoning the customer service and making them send a password reset link to a new email.

Also how do you manage said X number of emails? Do you log onto each one of them, or do you forward all emails to one "master email"? If so, the master email is still the single point of failure.