Reseting passwords using email addresses and birthdays. Admittedly, given the information that Sony knows about you, what else could they use to reset password

Reseting passwords using email addresses and birthdays. Admittedly, given the information that Sony knows about you, what else could they use to reset passwords that the bad guys don't have? Edit: Wait, reading more of the articles, this exploit doesn't send a password reset email, or similar, to the users; and just allows them to enter a new password? That's ... convenient, but at an enormous cost. I retract my confusion.