People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they alr

People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they already set (or never set one at all). If the helpdesk operator has the ability to change or otherwise set a destination for a recovery email/token/pin/secret to be sent then they have the ability to set their own account/device as the trusted reset device/account. There really isn't a way that normal people can use that would allow a helpdesk operator to give them back access to their account without also allowing the helpdesk operator to gain access to the account themselves if they so choose.