Do you have an account recovery flow? Delete it immediately.

Lol. Have fun doing this at scale for any consumer site.

Like everything else in security, having a password reset/account recovery flow is a trade-off between security and convenience. For the vast majority of websites, convenience wins.