You could allow the user to add secondary email addresses or phone numbers to their account for account recovery, but then any of this becomes the weak link for

You could allow the user to add secondary email addresses or phone numbers to their account for account recovery, but then any of this becomes the weak link for hacking their account.