https://splitstream.io/how-hackers-exploit-weak-password-recovery-mechanisms/