There seems to a lot of confusion, both in the article and in the comments, about the "3 trusted friends" password recovery. You have to manually select your trusted friends [1]. A fake account mimicking one of your friends will not be a "trusted friend" unless you make him or her one.
Furthermore, this is an opt-in feature.