This is something we struggled with at Exoscale, I took the time to do a small write-up of how we approach reset requests here: https://www.exoscale.ch/syslog/2016/04/13/i-lost-my-2-factor...