Comment by lxgr

That's why allowing account recovery using (exclusively) email is indeed a security problem.