It’s not a question of whether it’s technically possible but practical to expect people to maintain a recovery address which is not otherwise used or guessable.

It’s not a question of whether it’s technically possible but practical to expect people to maintain a recovery address which is not otherwise used or guessable. If you can pull it off, sure, but from a security perspective I’d probably be looking for a way to avoid email at all for this mechanism since it just wasn’t designed around address privacy.