> It's my information to be stolen, not yours.

Many computer logins protect information other than the password-bearer's- for example, any business or government. As a result it's best to consider it, then discard as your use case may require.

I absolutely agree on the account recovery point - it WILL happen, your choice as designer is just whether it happens within a designed process or without.