I'd give an admonishment to anyone who uses a password question from the standard set (mother's maiden name, etc.), even if it is hashed, because the data is so easily discoverable.

Nevertheless, the idea of a password question is so useful that I still support it on my sites. But our implementation is open-ended: you define your own question as well as its answer. I think this is better for anyone who is security conscious, but unfortunately it still allows the lazy or ignorant to be insecure.