Disagreed.
They could request knowledge that only the account owner would possess such as dates/locations of past activity, subjects of emails (received before the breach, so that the attacker can't just send out new emails to the target account), require multiple notarized proofs of ID or other past activity (get a letter from your ISP that attests that you had that IP address at that time, etc) and maybe a huge monetary deposit to that is required to start the process and is forfeited if bad faith is suspected.
The idea is to make the process as long, annoying and "dangerous" as possible to deter or make malicious activity unprofitable while still giving the rightful owner a chance. The legitimate owner wouldn't mind getting all these documents and leaving a huge paper trail behind him as well as waiting a month while the real owner of the account is spammed with notifications (allowing them to easily cancel the process if it turns out to be a takeover attempt), but an attacker trying to break into an account would think twice.