I side with facebook on this one. It isn't like anyone can arbitrarily enter an email address association, or re-enter an associated email during the reset process.

So, in order to get in there, you would need to know the account you're trying to get into, and have access to an associated account in order to lift the PIN from there.

It isn't to say that it cannot be done, but it does sound like a reasonable action.