[penprog]

Considering that for most websites one can easily reset the password to your account if they have access to your email, this adds no extra security risk (for those situations which are most common websites eg. Amazon, facebook, twitter etc). So this is NOT catastrophic for security because the current situation is already like this.

For websites where security is a larger issue, this obviously wouldn't be the solution.