There’s a trade off between preventing social engineering and giving people access to their lost account. And then add the issue that people don’t want to link online account to their real identity, so verification is hard.

I don’t really know how Twitter could have done better.