How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hir

How does someone even conceive of something like that without realizing the glaring problem with it? How does it pass muster at a major corporation that has hired security consultants? This is utterly flabbergasting. I could understand that much outrage if Sony deliberately designed the password reset process to require only e-mail address and DOB. However, the article says that the password reset page had an exploit that allowed you to do that. It's still shoddy security, but at least it's not sheer idiocy.