Unfortunately, it turns out to be really tough to handle every possible edge case correctly without a little bit of cronyism. People forget passwords, lose 2FA

Unfortunately, it turns out to be really tough to handle every possible edge case correctly without a little bit of cronyism. People forget passwords, lose 2FA devices, etc all the time. Many of the usual methods can be hijacked much more easily than you might think. It's tough to make the right call for legitimate user who messed something up versus a particularly sly attacker every time without some out-of-band personal knowledge about the person in question. All of the fancy tech in the world can't beat "Hey, I know Tom pretty well, this doesn't seem like something he would want to do. Maybe I better ring him up through a medium I trust to confirm this before I do it."