The fundamental flaw of pretty much every password recovery feature I’ve found online is that what they consider “secret” information actually isn’t thanks to social networking, blogs and even Wikipedia. Yahoo! Mail password recovery relies on asking you your date of birth, zip code and country of residence as a proof of identity. Considering that this is the kind of information that is on the average Facebook profile or MySpace page, it seems ludicrous that this is all that stops someone from stealing your identity online.
Dare Obasanjo on Password Recovery