You should have some sort of 2FA, or phone number, or have a system in place for managers to vouch for the employee by phone or something. Security questions a

You should have some sort of 2FA, or phone number, or have a system in place for managers to vouch for the employee by phone or something. Security questions are a vector for privacy breaches and much less effective than the above.