Why isn't this part of every password-reset procedure? "We'll mail a reset code to the postal address you gave when you created your account"

This would mean that the attacker would have to commit mail fraud, which (a) is quite difficult; and (b) carries heavy penalties in law.