This is a bit of a tangent, but Authy allows recovery of an account without access to either the original device or the original phone number. Does anyone know what actually happens when you go through this flow?

https://www.authy.com/phones/change/

It says they may perform "additional security checks" in the help but what are they? The wooliness of this makes me very nervous. (I don't use Authy fwiw)