Well, currently almost all password resets work over email. If you can read my email, you can reset all passwords for my bank accounts, shopping site accounts, etc. this solution is no worse than others.